T05 · Unauthorized Access and Privilege Escalation
Error
- Location
dashboard/websocket-feed.js:27- Finding
Unauthenticated WebSocket Clients Can Enable Fully Automated Trading
- Content
View full analysis
{ this.clients.add(ws); console.log(`[WS-FEED] Client connected. Total: ${this.clients.size}`); // Send current state on connect ws.send(JSON.stringify({ type: 'snapshot', data: this.latestState })); ws.on('close', () => { this.clients.delete(ws); }); ws.on('message', (msg) => { try { const cmd = JSON.parse(msg); if (cmd.action === 'setMode') { bus.setMode(cmd.mode); } } catch (e) { /* ignore */ } }); }); ``` The resulting mode directly controls whether execution events place broker orders: ```js // automation/event-bus.js:169-186 setMode(mode) { const oldMode = this.systemMode; this.systemMode = mode; const modeNames = { 1: 'Advisory', 2: 'Semi-Automated', 3: 'Fully-Automated', 4: 'Risk-Off' }; logger.info(`MODE CHANGE: ${modeNames[oldMode]} → ${modeNames[mode]}`); this.publish(this.EVENTS.SYSTEM_MODE_CHANGE, { oldMode, newMode: mode, modeName: modeNames[mode] }); } isAutoMode() { return this.systemMode === 3; } ``` ```js // broker/order-manager.js:20-23 bus.on(EVENTS.EXECUTION_ENTRY, async (signal) => { if (!bus.isAutoMode()) return; await this.executeSignal(signal); }); ``` ### Technical Analysis The WebSocket service accepts connections and commands without authenticating the client, authorizing control privileges, validating the request origin, or restricting mode transitions. It also passes `cmd.mode` directly to the global event bus without checking that it is an allowed numeric mode. Sett ...[truncated 1722 chars]- Remediation
View remediation