If you ever shared the #Lutris debug log (as requested by both the Forum as well as github issue page) while your #GOG account was connected:
You might've shared your secret API token publicly.
The Lutris logs seem to NOT hide *any* personal information in debug logs' HTTP requests. Including your private refresh token.
If you ever shared a Lutris debug log, de-auth sessions and change passwords immediately.
github.com/lutris/lutris/issue…
#Security #Linux #itchio #HumbleBundle
[SECURITY] Command `lutris -d` is leaking GOG API secrets · Issue #5967 · lutris/lutris
Bug description When starting lutris with the debug parameter -d, which is commonly used and requested in the Forum and right here to help users fix issues, displays the full GOG REST API string in...GitHub
This entry was edited (1 month ago)
Tay likes this.
reshared this
Natasha Nox 🇺🇦🇵🇸
in reply to Natasha Nox 🇺🇦🇵🇸 • • •Disclaimer: I'm not a security researcher or even fluent in Python. Further analysis by more capable people very much welcome.
From my point of view this looks like an absolute fuck up by the #Lutris team. Requesting debugs for your tool while coding said tool to just throw *every* HTTP request into the log file no matter its content is just screwed up.
Sven
in reply to Natasha Nox 🇺🇦🇵🇸 • • •from a *very* cursory look: client_secret and client_id are static values tied to lutris and not critical: github.com/lutris/lutris/blob/…
The refresh_token *is* a user-specific secret, (EDITED: see below, it *is* reusable, that's bad!)
lutris/lutris/services/gog.py at 2671d5361d3021f0079eb5db51d628d6f5201abb · lutris/lutris
GitHubNatasha Nox 🇺🇦🇵🇸
in reply to Sven • • •Sven
in reply to Natasha Nox 🇺🇦🇵🇸 • • •client_* is about the application. all it communicates is "this is lutris".
The refresh_token is tied to you - and if GOG let it be reused, which your test seems to prove, then yes, it is absolutely a problem!
Natasha Nox 🇺🇦🇵🇸
in reply to Sven • • •@HeNeArXn Ah, I see. What about client_secret though?
I was able to get a valid response for the account of my brother from a completely different IP and device after he shared a debug log with me, which caused me to alarm.
Sven
in reply to Natasha Nox 🇺🇦🇵🇸 • • •client_secret is as you can see from my link also public in practice. Ignore those.
The problem is the refresh_token alone, but that is totally a problem. So I suggest editing the issue to a) not mention the client_id/_secret, and b) make it clear that you were actually able to use curl to reuse the refresh_token from another computer, because the latter is the REALLY REALLY BAD part.
Natasha Nox 🇺🇦🇵🇸
in reply to Sven • • •Natasha Nox 🇺🇦🇵🇸
in reply to Natasha Nox 🇺🇦🇵🇸 • • •prisixia
in reply to Natasha Nox 🇺🇦🇵🇸 • • •github.com/lutris/lutris/issue…
p7zip security risk · Issue #2868 · lutris/lutris
GitHubNatasha Nox 🇺🇦🇵🇸
in reply to prisixia • • •PerfectDark
in reply to Natasha Nox 🇺🇦🇵🇸 • • •Natasha Nox 🇺🇦🇵🇸
in reply to PerfectDark • • •