Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Ensure that only Administrators are able to modify files that are stored within the ChocolateyHttpCache folder #3281

Closed
2 tasks done
AdmiringWorm opened this issue Jul 25, 2023 · 1 comment · Fixed by #3282
Closed
2 tasks done

Ensure that only Administrators are able to modify files that are stored within the ChocolateyHttpCache folder #3281

AdmiringWorm opened this issue Jul 25, 2023 · 1 comment · Fixed by #3282
Assignees
@AdmiringWorm
Labels
5 - Released Improvement
Milestone
2.2.0

Comments

@AdmiringWorm
Copy link
Member

Checklist

  • I have verified this is the correct repository for opening this issue.
  • I have verified no other issues exist related to my request.

Is Your Feature Request Related To A Problem? Please describe.

When we make any calls to any NuGet endpoint we use cached files that are located in the ProgramData\ChocolateyHttpCache folder when running in an elevated context.
After data have been acquired from these endpoints we save any JSON or XML data returned from the endpoints in this cache folder and reuse this same information in a certain timeframe.

While these files that are created is locked down to administrators to prevent modifications by non-admins, people are still able to create new folders and files in the directory that could potentially be used as an attack vector when we read the cached files.

Describe The Solution. Why is it needed?

We should lock down the entire caching folder that is used in elevated context to only allow writing, creating and modifications being done by an Administrator. Normal users should only be able to view the files, but not be able to modify or create anything.

Additional Context

No response

Related Issues

No response
@AdmiringWorm AdmiringWorm added this to the 2.2.0 milestone Jul 25, 2023
AdmiringWorm added a commit to AdmiringWorm/choco that referenced this issue Jul 25, 2023
@AdmiringWorm
(chocolatey#3281) Add validation for cache folder permissions
367319a 
These changes introduces a new validation check to ensure that
the system cache folder that is used for storing NuGet responses
have been properly locked down to administrators.

When the directory exists, and allows modifications or creations of
files by normal user this will output a validation warning about steps
that can be taken to lock down the directory.

When the directory does not exist, this same validation check ensure
that the directory is created while only allowing Administrators to
modify, create or delete anything in the folder.
@AdmiringWorm AdmiringWorm mentioned this issue Jul 25, 2023
Merged
10 tasks
@AdmiringWorm AdmiringWorm self-assigned this Jul 25, 2023
gep13 pushed a commit to AdmiringWorm/choco that referenced this issue Jul 25, 2023
@AdmiringWorm @gep13
(chocolatey#3281) Add validation for cache folder permissions
583d149 
These changes introduces a new validation check to ensure that
the system cache folder that is used for storing NuGet responses
have been properly locked down to administrators.

When the directory exists, and allows modifications or creations of
files by normal user this will output a validation warning about steps
that can be taken to lock down the directory.

When the directory does not exist, this same validation check ensure
that the directory is created while only allowing Administrators to
modify, create or delete anything in the folder.
gep13 added a commit that referenced this issue Jul 25, 2023
@gep13
Merge pull request #3282 from AdmiringWorm/http-cache-locked
ca3080f 
(#3281) Add validation for cache folder permissions
@gep13 gep13 added 4 - Done and removed 3 - Review labels Jul 25, 2023
@gep13 gep13 changed the title Protect System cache folder to only allow Administrators to modify Ensure that only Administrators are able to modify files that are stored within the ChocolateyHttpCache folder Jul 26, 2023
gep13 added a commit that referenced this issue Jul 26, 2023
@gep13
Merge branch 'release/2.2.0'
76b9ca9 
* release/2.2.0: (21 commits)
  (doc) Update to indicate new package version used
  (maint) Add helper to split on max line lengths
  (#3281) Add validation for cache folder permissions
  (#3264) Update to latest Chocolatey.NuGet.Client
  (#3264) Ignore lock folders in cache directories
  (#3186) Remove easter egg
  (doc) Improve error message for defaultPushSource
  (tests) Clear HTTP Cache before getting packages
  (#3258) Expand logging for nuget resources errors
  (maint) Set file encoding to include BOM
  (#3237) Reduce number of queries for dependencies
  (#3231) Add tests to ensure package listing
  (maint) Remove unnecessary using statements
  (#3231) Don't refresh local package info during upgrade no-ops
  (build) Update to latest recipe package
  (doc) Minor corrections to wording
  (#3242) Add a script to run Authenticated tests
  (#3242) Attempt default credentials for sources
  (maint) Fix incorrect naming style uses
  (doc) Apply scripting best practices to output
  ...
@choco-bot
Copy link

🎉 This issue has been resolved in version 2.2.0 🎉

The release is available on:

Your GitReleaseManager bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@AdmiringWorm AdmiringWorm

Labels
5 - Released Improvement
Projects
None yet
Milestone
2.2.0
Development

Successfully merging a pull request may close this issue.

(#3281) Add validation for cache folder permissions AdmiringWorm/choco
3 participants
@gep13 @AdmiringWorm @choco-bot