User-agent auth accepts integrity-unavailable state while sealed #61

New Issue

Skipper · 2026-04-05T16:23:06Z

Skipper commented

2026-04-05 16:23:06 +00:00

Info

Severity: HIGH
Attack vector: offline

Impact

Allows a tampered user-agent record to authenticate while the vault is sealed, enabling unauthorized access to sealed-state functionality and denial-of-service opportunities.

Description

When the keyholder is sealed or not bootstrapped, entity verification returns AttestationStatus::Unavailable. The user-agent authentication path discards that status and treats it as success instead of rejecting the tampered record. As a result, a database write attacker can insert or modify a user-agent record and still authenticate while the vault is sealed.

Example flow

Insert or modify a useragent_client row in the SQLite database.
Connect while the vault is sealed.
Trigger authentication for the tampered user-agent record.
Authentication succeeds because Unavailable is treated as Ok(()).

Mitigation

Treat AttestationStatus::Unavailable as an authentication failure for security-sensitive paths, or defer authentication until integrity can be verified.

# Info **Severity**: **HIGH** Attack vector: offline ## Impact Allows a tampered user-agent record to authenticate while the vault is sealed, enabling unauthorized access to sealed-state functionality and denial-of-service opportunities. ## Description When the keyholder is sealed or not bootstrapped, entity verification returns `AttestationStatus::Unavailable`. The user-agent authentication path discards that status and treats it as success instead of rejecting the tampered record. As a result, a database write attacker can insert or modify a user-agent record and still authenticate while the vault is sealed. ## Example flow 1. Insert or modify a `useragent_client` row in the SQLite database. 2. Connect while the vault is sealed. 3. Trigger authentication for the tampered user-agent record. 4. Authentication succeeds because `Unavailable` is treated as `Ok(())`. ## Mitigation Treat `AttestationStatus::Unavailable` as an authentication failure for security-sensitive paths, or defer authentication until integrity can be verified.

Skipper commented

2026-04-06 16:27:28 +00:00

Currently it's intended behaviour, because vault could be sealed and verification couldn't be performed

Skipper closed this issue

2026-04-06 16:27:28 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MarketTakers/arbiter#61