Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[W-3] Reseller auto-spend to self-signed fake upstream advertisement

Abierto
  • ¿Algo no está bien?
#802 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
22/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
go
Área
backend, payments, security

Línea de trabajo

Start by checking whether the finding still reproduces on current main, since the body says it was not re-verified after migration. The relevant code is upstream_session_manager/session.go around lines 325 and 374-399, where the kind-10021 allotment tag is trusted without signature or key checks and the gateway is contacted over plain HTTP. Done means either a confirmed reproduction with a fix that verifies session event signatures against an allowlist of gateway keys, or a written note that the issue no longer applies upstream.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Migrated from Amperstrand/tollgate-module-basic-go#72 as part of the fork retirement — OpenTollGate/tollgate-module-basic-go is the single source of truth; the fork issue carries the original discussion and any lab evidence. Retirement plan: #758.]

HIGH: Any interface-up event (including wired WAN DHCP) probes gateway :2121/. A self-signed (validly-signed but with untrusted key) kind-10021 advertisement naming a mint the router trusts triggers automatic, repeating real-token payments to the attacker's endpoint. The reported usage controls renewal pacing.

The attack flow: upstream_session_manager/session.go:325,374-399 uses plaintext HTTP and trusts the allotment tag without signature verification. This is network-triggered and requires no authentication.

Fix: Allowlist gateway keys and verify session events with signature validation.

Evidence: /home/ubuntu/src/tollgate_audit_report_2026-08-26.md §7, line 144
File references: upstream_session_manager/session.go:325,374-399

Migrated 2026-10-09. Applicability to current upstream main (4614ac2, post-rc1) was not re-verified during migration — confirming whether the finding still reproduces upstream is this issue's first task.

Lenguaje dominante
Go
Estrellas
12
Forks
14
Merge medio
3 d 18 h
PR fusionados (30 d)
284

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de OpenTollGate/tollgate-module-basic-go

Todos los issues de OpenTollGate/tollgate-module-basic-go

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.