Gateway token file readable by local users

Summary

The firezone-gateway authenticate command (previously firezone gateway authenticate) stores the Gateway's token in /etc/firezone/gateway-token. It wrote the file without setting its permissions. If the file did not exist yet, it was created with the default mode, typically 0644, which makes it readable by every user on the host. If the file already existed, it kept whatever mode it had.

Impact

Any unprivileged local user on the Gateway host could read the Gateway's token. A Gateway token is a single-owner credential: while the legitimate Gateway is connected, no other process can connect with it. While the legitimate Gateway is disconnected, for example during a restart or an outage, an attacker holding the token could connect in its place and receive traffic that Clients route to Resources in that Site.

Who is affected

Gateways installed by following Firezone's recommended deployment guides are not affected.

The Debian package creates /etc/firezone/gateway-token with mode 0400 when it is installed, and authenticate keeps that mode when it writes the token. Docker, the systemd install script, and the NixOS module do not use authenticate at all.

The issue is only exploitable on Gateways running 1.4.18 through 1.6.2 on hosts shared with untrusted local users, where the installation was modified or done by hand, for example:

• /etc/firezone/gateway-token was deleted, or its permissions loosened, before running authenticate.
• The firezone-gateway binary was installed manually, without the Debian package, and authenticate created the token file.

Remediation

Upgrade to Gateway 1.6.3 or later. See upgrading.

From 1.6.3, authenticate always sets /etc/firezone/gateway-token to mode 0400, owned by root, whether the file is new or already exists.

If the token file may have been readable by untrusted users, rotate the Gateway's token as described in Gateway tokens.

Workarounds

Restrict the token file's permissions:

sudo chown root:root /etc/firezone/gateway-token
sudo chmod 0400 /etc/firezone/gateway-token

Verify the result with stat -c '%a %U' /etc/firezone/gateway-token, which should print 400 root.

Credits

Reported by GitHub user @yssoe.