T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/deploy/templates/.env.example.txt:4
- Finding
- Unauthenticated Camera Control and Recording Management Exposed on All Network Interfaces<![CDATA[ ## Vulnerability Details **File Location**: `scripts/deploy/templates/.env.example.txt:4`, `scripts/service.py:273-668`, `scripts/service.py:763-771` **Vulnerability Type**: Missing authentication and authorization on a network-exposed camera API **Risk Level**: High ### Vulnerable Code The deployment configuration exposes the service on every available network interface: ```ini # Service configuration HOST=0.0.0.0 PORT={{PORT}} LOG_LEVEL=INFO # Output directory OUTPUT_DIR={{WORKING_DIR}}/output ``` The application uses this value when starting Uvicorn: ```python if __name__ == "__main__": host: str = os.getenv("HOST", "0.0.0.0") port: int = int(os.getenv("PORT", "27793")) uvicorn.run( "service:app", host=host, port=port, reload=False, workers=1 # Single process so the lock remains effective ) ``` Security-sensitive endpoints are registered without any authentication or authorization dependency: ```python @app.post("/start", response_model=StartResponse) async def start_recording(request: StartRequest) -> StartResponse: ... @app.post("/stop/{session_id}", response_model=StopResponse) async def stop_recording( session_id: str, request: StopRequest, background_tasks: BackgroundTasks ) -> StopResponse: ... @app.post("/capture", response_model=CaptureResponse) async def capture_image(request: CaptureRequest) -> CaptureResponse: ... @app.get("/output/{filename}") async def get_video(filename: str) -> FileResponse: ... @app.delete("/output/{filename}") async def delete_file(filename: str) -> JSONResponse: ... @app.get("/outputs/") async def list_outputs( limit: int = Query(default=20, ge=1, le=100), offset: int = Query(default=0, ge=0) ) -> JSONResponse: ... ``` ### Technical Analysis Binding to `0.0.0.0` makes port 27793 reachable through every configured interface unless an external firewall blocks it. The FastAPI application does not requir ...[truncated 2619 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Change the deployment default to loopback-only access: ```ini HOST=127.0.0.1 ``` 2. Require authentication and authorization on every endpoint, including status, heartbeat, listing, download, and deletion endpoints. Use a FastAPI dependency that validates a securely generated bearer token or API key. 3. Do not return active session IDs, complete server filesystem paths, or other control credentials through an unauthenticated status endpoint. 4. For remote access, place the service behind a hardened TLS reverse proxy or use mutual TLS. Do not transmit camera data or credentials over plaintext HTTP. 5. Apply network restrictions: - Permit only explicitly trusted client addresses. - Block port 27793 on public and untrusted interfaces. - Consider access through a VPN or local Unix socket. 6. Separate read, capture, recording, and deletion permissions where multiple clients are supported. Destructive operations should require stronger authorization. 7. Add rate limiting, request auditing, and limits on recording duration and storage consumption. 8. Document the security boundary and warn operators not to expose the service directly to untrusted networks. ]]>