published November 21, 2019
⚠️ A bug in Zulip’s signup process lets attackers snag personal API keys. It’s like leaving your car keys in the ignition while parked in a sketchy neighborhood! 🚗💨 Think of it this way: when you sign up for a club, you might have a badge that lets you access certain areas. But what if someone could copy that badge without you noticing? That’s exactly what’s happening here with the API keys being exposed during social signups. An unprivileged attacker could steal a user’s personal API key, which grants them nearly full access to the account. This means they could potentially read messages, change settings, or even impersonate the user. That’s a recipe for absolute chaos in your organization!
Think of it this way: when you sign up for a club, you might have a badge that lets you access certain areas. But what if someone could copy that badge without you noticing? That’s exactly what’s happening here with the API keys being exposed during social signups. In Zulip Server versions from 1.7.0 to before 2.0.7, a flaw in the new user signup process allows users registering with social authentication to have their personal API keys exposed to attackers in organizations that permit password authentication.
An unprivileged attacker could steal a user’s personal API key, which grants them nearly full access to the account. This means they could potentially read messages, change settings, or even impersonate the user. That’s a recipe for absolute chaos in your organization! Immediately update Zulip Server to version 2.0.7 or later to patch this vulnerability. Additionally, review user permissions and consider restricting social authentication temporarily if possible. Stay vigilant about security practices! This is fixable! Act now, and you'll keep your users safe and sound. 🛡️