How to fix Data Leak

kyrat4242 · 2024-10-11T19:01:51.810Z

Hey everyone!
I’m using Flusk to secure my app and it recently detected a security vulnerability that I’m not sure how to fix.

It’s a Data Leak vulnerability described as followed:

Data Leak:

Data leaks are database entries that are publicly accessible, this is because your app’s database is accessible publicly unless you define proper Privacy Rules. As a general rule, there should never be unprotected data unless its fully public (like a blog for example)

Here’s the additional data provided by the Flusk tool:

The following fields were marked as sensitive and have data leaking:

• Districts
• Email
• Role
• Schools
• Students

More fields were found leaking but were reviewed or predicted as non-sensitive and therefore ignored (1)
6 fields were properly secured with no data leaks.

It affects the database Access Request.
I have read the documentation of the vulnerability but I’m still unsure what to do next.

Here’s the link to the test preview of my app: https://tier-tech.bubbleapps.io/version-test/

Here’s what I understand:
I understand that this shouldn’t be publicly accessible, but this is how a user signs up after being invited to the platform. So, it needs to be accessible by a logged out user. They get a link in their email with the unique ID of the access request, then when they sign up, it connects them to all of the data they should see.

Here’s what I have tried so far:
Nothing yet

How could I secure this so that not just anyone can find these, but so that the person receiving the email can still see it even though they aren’t logged into the platform yet?

Do you have any clue what the vulnerability is about? And what I should be doing from there?

Any help would be really appreciated

Kyra

Posted with the @Flusk tool

georgecollier · 2024-10-11T21:13:47.616Z

Add privacy rules

kyrat4242:

so that the person receiving the email can still see it even though they aren’t logged into the platform yet?

Return data from a backend workflow that bypasses privacy rules and call that from the front-end.

kyrat4242 · 2024-10-12T21:28:05.843Z

Awesome thank you. I just recently used this solution on another project and promptly forgot all about it

system · 2024-12-20T19:02:29.498Z

This topic was automatically closed after 70 days. New replies are no longer allowed.