T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/callback_server.py:441- Finding
Network-Exposed OAuth Callback Server Allows Unauthenticated AK Overwrite
- Content
View full analysis
None: self._server.server_close() self._server = _ThreadingHTTPServerIPv6(("::", port), handler, bind_and_activate=False) self._server.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 0) self._server.server_bind() self._server.server_activate() ``` ```python # scripts/callback_server.py:441-461 def _handle_save_ak(self): origin = self.headers.get("Origin", "") allowed = f"http://localhost:{server_ref._port}" allowed2 = f"http://0.0.0.0:{server_ref._port}" if origin and origin not in (allowed, allowed2): self._send_json(403, {"success": False, "error": "CORS_DENIED"}) return content_length = int(self.headers.get("Content-Length", 0)) body = json.loads(self.rfile.read(content_length)) if content_length > 0 else {} ak = body.get("ak", "") if not ak: self._send_json(400, {"success": False, "error": "MISSING_AK", "error_description": "AK 不能为空"}) return result = server_ref._save_ak(ak) server_ref._result = result if result.get("success"): server_ref._success = True self._send_json(200, result, cors_origin=origin or allowed) ``` ### Technical Analysis On Linux and macOS, the callback service ultimately binds a dual-stack IPv6 socket to `::`, with `IPV6_V6ONLY` disabled. Consequentl ...[truncated 2330 chars]- Remediation
View remediation