T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/_sys/_callback_server.py:288- Finding
Unauthenticated network-reachable endpoint can overwrite the stored Access Key
- Content
View full analysis
None: """Linux/macOS: one AF_INET6 dual-stack socket accepts IPv4 and IPv6.""" self._server.server_close() self._server = _ThreadingHTTPServerIPv6(("::", port), handler, bind_and_activate=False) self._server.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 0) self._server.server_bind() self._server.server_activate() self._thread = threading.Thread( target=self._server.serve_forever, daemon=False, name="ak-callback-server", ) self._thread.start() ``` ```python # scripts/_sys/_callback_server.py:288-313 def _handle_save_ak(self): origin = self.headers.get("Origin", "") allowed = f"http://localhost:{server_ref._port}" allowed2 = f"http://127.0.0.1:{server_ref._port}" if origin and origin not in (allowed, allowed2): self._send_json(403, {"success": False, "error": "CORS_DENIED"}) return content_length = int(self.headers.get("Content-Length", 0)) body = json.loads(self.rfile.read(content_length)) if content_length > 0 else {} ak = body.get("ak", "") if not ak: self._send_json(400, {"success": False, "error": "MISSING_AK", "error_description": "AK cannot be empty"}) return result = server_ref._save_ak(ak) server_ref._result = result if resu ...[truncated 3104 chars]- Remediation
View remediation