T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- app/main.py:31
- Finding
- Unauthenticated Policy Administration Enables Complete Guardrail Bypass<![CDATA[ ## Vulnerability Details **File Location**: `app/main.py:31-79` **Vulnerability Type**: Missing authentication and authorization on security-critical policy administration endpoints **Risk Level**: High ### Vulnerable Code ```python @app.post("/policies", response_model=PolicyResponse, status_code=status.HTTP_201_CREATED) def create_policy_endpoint(payload: PolicyCreate, db: Session = Depends(get_db)) -> PolicyResponse: try: policy = create_policy(db, payload) except ValueError as exc: raise HTTPException(status_code=400, detail=str(exc)) from exc return PolicyResponse.model_validate(policy) @app.get("/policies", response_model=list[PolicyResponse]) def list_policies_endpoint(db: Session = Depends(get_db)) -> list[PolicyResponse]: return [PolicyResponse.model_validate(p) for p in list_policies(db)] @app.get("/policies/{policy_id}", response_model=PolicyResponse) def get_policy_endpoint(policy_id: str, db: Session = Depends(get_db)) -> PolicyResponse: policy = get_policy(db, policy_id) if not policy: raise HTTPException(status_code=404, detail="Policy not found") return PolicyResponse.model_validate(policy) @app.patch("/policies/{policy_id}", response_model=PolicyResponse) def update_policy_endpoint(policy_id: str, payload: PolicyUpdate, db: Session = Depends(get_db)) -> PolicyResponse: policy = get_policy(db, policy_id) if not policy: raise HTTPException(status_code=404, detail="Policy not found") try: updated = update_policy(db, policy, payload) except ValueError as exc: raise HTTPException(status_code=400, detail=str(exc)) from exc return PolicyResponse.model_validate(updated) @app.delete("/policies/{policy_id}", status_code=status.HTTP_204_NO_CONTENT) def disable_policy_endpoint(policy_id: str, db: Session = Depends(get_db)) -> Response: policy = get_policy(db, policy_id) if not policy: raise HTTPException(status_code=404, det ...[truncated 3171 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require authentication for every non-health endpoint using a verified service identity, OAuth2 access token, mutual TLS certificate, or equivalent mechanism. 2. Implement role-based authorization: - Permit ordinary agent identities to call only `POST /evaluate`. - Permit policy readers to access policy metadata where necessary. - Restrict policy creation, modification, disablement, and seeding to dedicated administrator roles. 3. Disable or remove `POST /seed` in production, or protect it with the same administrative authorization controls. 4. Constrain policy priorities to an approved range and reserve the highest priority range for immutable mandatory controls. 5. Prevent ordinary administrators from creating permissive policies that override mandatory `DENY` rules. 6. Require change approval or dual control for high-impact policy updates. 7. Record authenticated actor identity, before-and-after policy values, timestamps, and request provenance in tamper-resistant administrative audit logs. 8. Add authorization tests proving that anonymous and evaluation-only identities cannot create, patch, disable, or seed policies. 9. Deploy the API behind TLS and restrict network access to trusted workloads even after application-layer authentication is implemented. ]]>