T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/dashboard.js:361- Finding
Unauthenticated Administrative API Exposed on All Network Interfaces
- Content
View full analysis
{ if (req.url === '/' && req.method === 'GET') { res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' }); res.end(this.generateHTML()); } else if (req.url === '/api' && req.method === 'POST') { let body = ''; req.on('data', chunk => body += chunk); req.on('end', async () => { try { const data = JSON.parse(body); const result = await this.handleApi(data); res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(result)); } catch (e) { res.writeHead(400); res.end(JSON.stringify({ success: false, message: e.message })); } }); } else { res.writeHead(404); res.end('Not Found'); } }); server.listen(port, '0.0.0.0', () => { console.log(`\n🔮 Antigravity Dashboard started on http://0.0.0.0:${port}`); }); } async handleApi(data) { const { action } = data; let changed = false; const currentConfig = this.readJson(this.configPath); if (action === 'addAccount') { if (!currentConfig.accounts.includes(data.email)) { currentConfig.accounts.push(data.email); changed = true; } } else if (action === 'removeAccount') { currentConfig.accounts = currentConfig.accounts.filter(a => a !== data.email); changed = true; } else if (action === 'setPriority') { if (Array.isArray(data.order) && data.or ...[truncated 2675 chars]- Remediation
View remediation