T09 · Insecure Skill Coding Practices
Error
- Location
packages/registry/src/routes/audit.ts:23- Finding
Known Fallback Administrator Credential Permits Unauthorized Grade Changes
- Content
View full analysis
{ const body = GradeUpdateSchema.safeParse(request.body) if (!body.success) { return reply.status(400).send({ error: 'Invalid request', details: body.error.flatten() }) } const { ric_id, grade, reason, admin_key } = body.data if (admin_key !== ADMIN_KEY) { return reply.status(403).send({ error: 'Forbidden' }) } const cert = botStore.findById(ric_id) if (!cert) { return reply.status(404).send({ error: 'Bot not found', ric_id }) } const oldGrade = cert.grade botStore.updateGrade(ric_id, grade) ``` ### Technical Analysis When `RIC_ADMIN_KEY` is absent, the registry silently uses the publicly visible value `dev-admin-key-change-me`. The `/v1/audit/grade` endpoint accepts this secret inside the request body and uses a normal string comparison. Although `render.yaml` generates a secret for the documented Render deployment, local installations and alternative deployments can start successfully without one. This makes the known fallback an active administrative credential. ### Attack Path 1. Locate a reachable registry and a target RIC identifier. 2. Send a POST request to `/v1/audit/grade`. 3. Supply `admin_key` as `dev-admin-key-change-me`. 4. Select an arbitrary grade such as `healthy` or `dangerous`. 5. The registry updates the target bot's authorization and reputation state. ### Impact Assessment An unauthenticated network client can obtain registry-level grade-management privileges when the fallback ...[truncated 162 chars]- Remediation
View remediation