Executive brief
SSB-DB is a database library used in peer-to-peer secure messaging networks. A bug in the get() method causes it to automatically decrypt private messages instead of requiring explicit decryption, allowing malicious peers to read encrypted conversations if they can access the database through the SSB-OOO plugin (enabled by default). This exposes confidential user communications to unauthorized disclosure.
Technical details
The vulnerability is an information disclosure flaw (CWE-200) in SSB-DB version 20.0.0 affecting the get() method's encryption handling. The root cause is a logic error where the method decrypts all messages it has a key for, rather than only decrypting when explicitly requested. The attack requires network access to a node running SSB-DB 20.0.0 with the SSB-OOO plugin enabled (default configuration), and targets private messages stored on the affected peer. An attacker can call get() via SSB-OOO to retrieve decrypted private message content, compromising message confidentiality. The vulnerability was patched in SSB-DB 20.0.1 and SSB-Server 16.0.1; disabling the SSB-OOO plugin provides temporary mitigation.
Affected products
- SSB Collective SSB-DB 20.0.0
- SSB Collective SSB-Server 16.0.0
Timeline
- 2020-06-11: disclosed: GHSA-mpgr-2cx9-327h published
- 2020-06-11: patched: SSB-DB 20.0.1 and SSB-Server 16.0.1 released