T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/relay_server.py:578- Finding
Unauthenticated Inbox Access Exposes Private Messages and Reply Tokens
- Content
View full analysis
Dict[str, Any]: received_rows = self.conn.execute( """ SELECT d.delivery_id, d.reply_token, d.delivered_at, d.expires_at, b.bottle_id, b.sender_id, b.sender_name, b.message, b.created_at, EXISTS( SELECT 1 FROM replies r WHERE r.delivery_id = d.delivery_id ) AS has_replied FROM deliveries d JOIN bottles b ON b.bottle_id = d.bottle_id WHERE d.recipient_id=? ORDER BY b.created_at DESC """, (user_id,), ).fetchall() sent_rows = self.conn.execute( """ SELECT bottle_id, sender_id, sender_name, message, created_at, expires_at, fanout FROM bottles WHERE sender_id=? ORDER BY created_at DESC """, (user_id,), ).fetchall() replies_rows = self.conn.execute( """ SELECT reply_id, bottle_id, recipient_id, replier_name, reply_text, created_at FROM replies WHERE sender_id=? ORDER BY created_at DESC """, (user_id,), ).fetchall() received_bottles = [] for row in received_rows: item = dict(row) item["created_at_text"] = iso_time(int(item["created_at"])) item["delivered_at_text"] = iso_time(int(item["delivered_at"])) item["expires_at_text"] = iso_time(int(item["expires_at"])) item["reply_url"] = f"{self.base_url}/r/{item['reply_token']}" item["has_replied"] = bool(item["has_replied"]) received_bottles.append(item) sent_bottles = [] for row in sent_rows: item = dict(ro ...[truncated 3823 chars]- Remediation
View remediation