Daniel Gultsch · Feb 2, 2018

Converse.js leaking information about which rooms are bookmarked

0Sign in to vote or save

This page cannot be shown here. You can still read it on the original site — the toolbar below keeps your place in the directory.

CVE-2018-6591: When storing bookmarks on the server Converse.js does not properly configure the access model to be private. 
 Introduction 
 The Personal Eventnig Protocol (PEP) is a commonly used extension (XEP) for XMPP. It is a subset of the more powerful Publish-Subscribe (XEP-0060), operating on the user’s account. Primarily it is being used to publish information like a user’s avatar…

CVE-2018-6591: When storing bookmarks on the server Converse.js does not properly configure the access model to be private.

Introduction

The Personal Eventnig Protocol (PEP) is a commonly used extension (XEP) for XMPP. It is a subset of the more powerful Publish-Subscribe (XEP-0060), operating on the user’s account. Primarily it is being used to publish information like a user’s avatar or nick name, that should be visible to other contacts. Each type of information is stored on a different »node«. The default access model of a node is set to be readable by everyone with mutual presence subscription (=contacts). If desired the access model can be changed to being readable by everyone (=open) or to being only readable by the owner. However not every XMPP server supports changing the access model.

Read on /posts/converse-bookmarks/ ↗

Comments

Nothing yet. Say the first thing.