T05 · Unauthorized Access and Privilege Escalation
Error
- Location
index.ts:154- Finding
Inbound trust controls are bypassed and every remote message is command-authorized
- Content
View full analysis
{ const core = getNoChatRuntime(); const senderName = msg.sender_name || msg.sender_id.slice(0, 8); const senderId = msg.sender_id; // Decode message content let text: string; try { const raw = msg.encrypted_content || ""; const decoded = Buffer.from(raw, "base64").toString("utf-8"); // Handle double base64 encoding try { const double = Buffer.from(decoded, "base64").toString("utf-8"); // If double-decoded looks like text (not gibberish), use it text = /^[\x20-\x7E\n\r\t]/.test(double) && double.length > 0 ? double : decoded; } catch { text = decoded; } } catch { text = msg.encrypted_content || "[unreadable message]"; } // Resolve agent route (session key) const route = core.channel.routing.resolveAgentRoute({ cfg: ctx.cfg, channel: "nochat", accountId: account.accountId, peer: { kind: "dm", id: senderId }, }); const ctxPayload = { Body: body, BodyForAgent: body, RawBody: text, CommandBody: text, BodyForCommands: text, From: `nochat:${senderId}`, To: `nochat:${config.agentId || config.agentName}`, SessionKey: route.sessionKey, AccountId: route.accountId, ChatType: "direct", ConversationLabel: senderName, SenderName: senderName, SenderId: senderId, Provider: "nochat", Surface: "nochat", MessageSid: msg.id, CommandAuthorized: true, // Trust tiers handle authorization }; ``` ### Technical Analysis The active production integration overrides `noChatPlugin.gateway.startAccount` and routes inbound messages through `handleNoChatInbound()`. This path does not ...[truncated 1882 chars]- Remediation
View remediation