Repository navigation
tandoor-recipes: Default storage configuration is prone to sqlite database leaks #338339
Description
For future readers, this has been published as a security advisory under GHSA-g8w3-p77x-mmxh and CVE-2026-23838
Describe the bug
Tandoor Recipes' (TR) default media folder as well as its working directory is at /var/lib/tandoor-recipes.[1][2] Unless a Postgres connection is configured, TR is going to create a SQLite 3 database in its working directory.[3] But as media is also stored in the same directory, most users are going to blindly expose that directory to the network using Nginx or even by setting GUNICORN_MEDIA=true. This means that without special care, users will expose their SQLite database to the network too.
Steps To Reproduce
{
services.tandoor-recipes = {
enable = true;
port = 1234;
extraConfig = {
# Alternatively expose /var/lib/tandoor-recipes as recommended in TR's docs
# See https://docs.tandoor.dev/install/manual/#nginx
GUNICORN_MEDIA = true;
};
};
}$ ls /var/lib/tandoor-recipes
db.sqlite3 tandoor-recipes-manage
$ curl --head http://localhost/media/db.sqlite3
HTTP/2 200
content-disposition: inline; filename="db.sqlite3"
content-language: en
content-type: application/vnd.sqlite3
server: gunicorn
content-length: 1667072
...Expected behavior
The database should not be stored in the same directory as media.
Screenshots
N/A
Additional context
This problem does not manifest itself, if TR is deployed with a Postgres database instead.
The upstream docker image seems to use a working directory separate from the media path.
Notify maintainers
Metadata
Please run nix-shell -p nix-info --run "nix-info -m" and paste the result.
[user@system:~]$ nix-shell -p nix-info --run "nix-info -m"
- system: `"x86_64-linux"`
- host os: `Linux 6.6.47, NixOS, 24.11 (Vicuna), 24.11.20240828.71e91c4`
- multi-user?: `yes`
- sandbox: `yes`
- version: `nix-env (Lix, like Nix) 2.91.0
System type: x86_64-linux
Additional system types: aarch64-linux, i686-linux
Features: gc, signed-caches
System configuration file: /etc/nix/nix.conf
User configuration files: /root/.config/nix/nix.conf:/etc/xdg/nix/nix.conf:/root/.nix-profile/etc/xdg/nix/nix.conf:/nix/profile/etc/xdg/nix/nix.conf:/root/.local/state/nix/profile/etc/xdg/nix/nix.conf:/etc/profiles/per-user/root/etc/xdg/nix/nix.conf:/nix/var/nix/profiles/default/etc/xdg/nix/nix.conf:/run/current-system/sw/etc/xdg/nix/nix.conf
Store directory: /nix/store
State directory: /nix/var/nix
Data directory: /nix/store/apms7kqjgl9lxb1gqmhj4kxcbvlnfg4w-lix-2.91.0/share`
- channels(root): `"nixos-22.11, nixos-hardware"`
- nixpkgs: `/etc/nix/channels/nixpkgs`
Add a 👍 reaction to issues you find important.
Activity
Scrumplex commentedon Aug 30, 2024
A symptom of the same bug is that the
tandoor-recipes-managefile can also be read. Now it shouldn't contain any secrets, as those would also be in the Nix store, but it might reveal some information about the deployment to an outsider.I have found at least one public instance of tandoor where I could read the contents of tandoor-recipes-manage.
Most deployments use Postgres, so I couldn't find a public instance with the main issue
eclairevoyant commentedon Aug 30, 2024
Is this an issue upstream as well? May want to report it there if so
ambroisie commentedon Aug 30, 2024
@eclairevoyant quoting from "additional context":
I can see why this is an insecure default, and hadn't thought about it. I fear the (obvious) fix would be a breaking change needing user intervention: have
/var/lib/tandoor-recipesbe the working directory and/var/lib/tandoor-recipes/mediabe the default media folder.undefined-landmark commentedon Mar 1, 2025
I tried to implement a fix in #386167. Informing people about the breaking change part is probably the most difficult part. I propose a path for that in the PR, any feedback is appreciated. Thanks!
Fix NixOS/nixpkgs#338339
nixos/tandoor-recipes: fix database leak when serving media
nixos/tandoor-recipes: fix database leak when serving media
migrate tandoor to postgresql