Executive brief
CaSS is an open-source library used to manage learning records and competency data in educational systems. The library failed to apply a required cryptographic step when storing account keys during standalone username/password authentication, allowing server administrators to access users' cryptographic keys that should have been protected end-to-end. This undermines the intended security model where users' credentials remain encrypted and inaccessible to the server.
Technical details
CaSS Project contains a missing cryptographic step (CWE-325) in its key storage mechanism when using standalone username/password authentication. The vulnerability affects the CaSS Library (npm package cassproject) versions before 1.5.8, where cryptographic keys are not properly protected during storage, allowing server administrators with system access to retrieve users' cryptographic keys. The attack requires local server access and affects only deployments using standalone authentication; SSO and client-certificate authentication are not impacted as they do not provide the same zero-knowledge credential expectation. The issue was patched in version 1.5.8, though previously compromised accounts only regain full cryptographic protection upon the user's next login.
Affected products
- CaSS Project CaSS < 1.5.8
Timeline
- 2022-05-17: disclosed
- 2022-05-25: patched: version 1.5.8 released