T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/dashboard.js:361
- Finding
- Unauthenticated Administrative API Exposed on All Network Interfaces<![CDATA[ ## Vulnerability Details **File Location**: `scripts/dashboard.js:361-414` **Vulnerability Type**: Missing authentication and authorization on a network-accessible management interface **Risk Level**: High ### Vulnerable Code ```js start() { const port = this.config.dashboardPort || 18090; const server = http.createServer(async (req, res) => { if (req.url === '/' && req.method === 'GET') { res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' }); res.end(this.generateHTML()); } else if (req.url === '/api' && req.method === 'POST') { let body = ''; req.on('data', chunk => body += chunk); req.on('end', async () => { try { const data = JSON.parse(body); const result = await this.handleApi(data); res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(result)); } catch (e) { res.writeHead(400); res.end(JSON.stringify({ success: false, message: e.message })); } }); } else { res.writeHead(404); res.end('Not Found'); } }); server.listen(port, '0.0.0.0', () => { console.log(`\n🔮 Antigravity Dashboard started on http://0.0.0.0:${port}`); }); } async handleApi(data) { const { action } = data; let changed = false; const currentConfig = this.readJson(this.configPath); if (action === 'addAccount') { if (!currentConfig.accounts.includes(data.email)) { currentConfig.accounts.push(data.email); changed = true; } } else if (action === 'removeAccount') { currentConfig.accounts = currentConfig.accounts.filter(a => a !== data.email); changed = true; } else if (action === 'setPriority') { if (Array.isArray(data.order) && data.or ...[truncated 2675 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Bind to `127.0.0.1` or a Unix-domain socket by default: ```js server.listen(port, '127.0.0.1'); ``` 2. Require strong authentication before permitting any API action. For remote administration, place the dashboard behind an authenticated TLS reverse proxy. 3. Implement per-action authorization rather than treating every authenticated user as an administrator. 4. Validate the `Origin` header and use CSRF tokens for browser-originated state-changing requests. 5. Define strict schemas for every action and reject unknown fields, malformed account names, invalid indices, and unapproved model identifiers. 6. Set a small maximum request-body size and terminate oversized requests. 7. Add security logging and rate limiting for failed authentication and state-changing operations. 8. Do not expose the dashboard externally unless the operator explicitly opts in. ]]>