Community-Driven Security Updates are Awesome!
The core of CDR Link is built upon the open-source project Zammad. Zammad is an amazingly flexible bit of technology, allowing for all kinds of ways to import and export data. By default, Zammad is a digital security helpdesk. However, we’ve been exploring and adapting it for many other uses, including as a disinformation data collection platform.
Throughout our process one thing remains central – the integrity and security of what we build and use.
Since the Zammad platform is so central to our work at CDR and the work of our partners, it’s essential that we verify the integrity and security of the code. With the support of Open Technology Fund our partners at Guardian Project put the platform through a detailed security audit. We are happy to report the results are released and many of our recommendations have been incorporated into the most recent Zammad release, version 3.3.
In fact, security was the biggest priority of their release! :)
All the security updates are important, but those listed below were triggered specifically by our audit. Click the links and dig in!
- Persistent Cross-site Scripting: https://zammad.com/news/security-advisory-zaa-2020-01 and https://zammad.com/news/security-advisory-zaa-2020-02
- Password Hashes Returned in Response of Own Session: https://zammad.com/news/security-advisory-zaa-2020-04
- Authorization Issues Allow for Users to View Data from Others: https://zammad.com/news/security-advisory-zaa-2020-04
- Application Functionality Can Be Used to Deter mine Existing User Accounts: https://zammad.com/news/security-advisory-zaa-2020-07
- Information Disclosure in HTTP Headers of default config example: https://zammad.com/news/security-advisory-zaa-2020-08
- Source Code Disclosure: https://zammad.com/news/security-advisory-zaa-2020-09
- Information Disclosure via Verbose Error Messages: https://zammad.com/news/security-advisory-zaa-2020-10
- Application Allows for Sensitive Information Caching: https://zammad.com/news/security-advisory-zaa-2020-11
