T05 · Unauthorized Access and Privilege Escalation
Error
- Location
server.js:678- Finding
Unauthenticated TTS Gateway Exposed on All Network Interfaces
- Content
View full analysis
{ try { if (req.method === 'GET' && req.url === '/health') { return sendJson(res, 200, { status: 'ok', port: config.port }); } if (req.method === 'GET' && req.url.startsWith('/api/session/state')) { const url = new URL(req.url, 'http://127.0.0.1'); const sessionId = url.searchParams.get('sessionId') || config.openclawSession; const userId = url.searchParams.get('userId') || 'anonymous'; const current = getSessionState(sessionId, userId).session; return sendJson(res, 200, { success: true, session: current }); } if (req.method === 'POST' && req.url === '/api/workflow/message') { const body = await readJsonBody(req); const result = await handleWorkflowMessage(body || {}); return sendJson(res, 200, result); } if (req.method === 'POST' && req.url === '/api/workflow/reference-audio') { const parsed = await parseMultipart(req); // Audio processing and storage follow without authentication. } if (req.method === 'POST' && req.url === '/api/tts/custom-speak') { const body = await readJsonBody(req); const result = await synthesizeCustomVoice({ text: body.text, style: body.style || '普通', language: body.language || config.defaultLanguage, speakerId: body.speakerId || config.defaultSpeaker, }); return sendJson(res, 200, { success: true, ...result }); } if (req.method === 'POST' && req.url === '/api/tts/clone-speak') { const body = await readJsonBody(req); const result = await synthesizeClonedVoice({ text: body.text, referenceAudioPath: body.referenceAudioPath, language: body.language || config.defaultLanguage, ...[truncated 2064 chars]- Remediation
View remediation
{ // ... }); ``` 2. Require a cryptographically random API token on every non-health endpoint. 3. Compare tokens using a timing-safe comparison and store them outside source-controlled configuration. 4. Enforce authorization so callers can only access state belonging to their own session and user identity. 5. If remote access is required, place the service behind a mutually authenticated TLS reverse proxy. 6. Apply firewall rules that limit port 9002 to trusted local or management interfaces. 7. Add request rate limits, audit logging, and inference quotas. 8. Avoid returning internal filesystem paths and detailed internal errors to untrusted callers. ]]>