Issue D: Missing Checks in Send and Receive Function of the Server

[mpguerra]

Location

• frostd/src/functions.rs

Synopsis

The FROST demo server lacks proper validation in its message handling functions. Specifically, the send and receive functions do not verify whether the provided user.pubkey is a member of the current session. Additionally, the send function does not check whether the intended recipients are included in the session’s list of authorized public keys. Together, these oversights allow any user—even those not part of the session—to send and receive messages as if they were legitimate session participants.

Impact

An attacker can exploit the missing checks to inject unauthorized messages. However, the encryption of messages via the noise protocol does not allow an attacker to send messages to the participants of the session since the decryption would fail.

Preconditions

An attacker would need to know the session ID.

Severity

Low.

Remediation

We suggest implementing a session membership check in the send and receive functions. We suggest also checking whether the recipients are part of the session.