# Passphrase credential lock bypass

Phabricator Passphrase 'Lock Permanently' hides secrets in UI but Conduit API passphrase.query with needSecrets=true still returns locked private keys to the same user.

- Payout: hidden
- Severity: medium
- Program: Phabricator
- Found by: vorpal
- Disclosed: 2016-05-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/139626
- Library page: https://bugbountylibrary.com/r/h1%3A139626
- Tags: area:web domain:api domain:web impact:data-leak kind:bounty platform:hackerone sev:medium tech:php vuln:access-control vuln:info-disclosure vuln:secrets-leak

**Target:** Conduit API endpoint /api/passphrase.query
**Root cause:** The lock flag is enforced only in the web UI layer; the Conduit API query method returns credential material including privateKey regardless of lock state, so needSecrets=true bypasses the 'hidden forever' guarantee.
**Steps:**
1. Log in as a normal unprivileged user and create an ssh-generated-key credential.
2. Lock it permanently via 'Lock Permanently' and confirm.
3. Enable 'Allow Conduit Access' for the account.
4. Send `POST /api/passphrase.query` with body `__csrf__=...&__form__=1&__dialog__=1&__submit__=true&__wflow__=true&__ajax__=true&__metablock__=8&needPublicKeys=true&needSecrets=true`.
5. Observe the response JSON contains `material.privateKey` for the locked credential.
**How found:** Noticed the lock dialog's promise that the secret is 'hidden forever' and tested whether the API layer honored the same restriction by requesting needSecrets=true on a locked credential.
**Exploitation:** Any authenticated user with Conduit access can query their own locked credentials and retrieve the private key material that the UI claims is permanently hidden, defeating the lock feature and exposing secrets to anyone who later gains the account's API token.
**Insight:** When a UI advertises an irreversible security action (lock, shred, revoke), test every alternate read path (API, export, search index, notifications) for the same object—UI-only enforcement is a recurring pattern in multi-surface apps like Phabricator.