Skip to content

LAN room key is brute-forceable without server-side rate limiting #26

Description

@carochacs

Found during a security audit.

Where: screen.js:414-445, ROOM_KEY_ALPHABET

Issue: 6-char key over a 30-symbol alphabet (~7.3×10⁸ combinations) is brute-forceable given enough time; the code's own comment relies on server-side rate-capping (in the feedBack core repo, not this plugin) to make scanning impractical.

Impact: Design tradeoff, not a code bug in this repo — filing to make sure the server-side rate-capping this plugin's design depends on actually exists and is tracked.

Suggested fix: Verify/implement per-IP or per-key connection rate limiting on feedBack core's /ws/sync/{room_key} endpoint.

Metadata

Metadata

Assignees

Labels

securityThis is a security issue

Type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions