T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- fleet_bus.js:133
- Finding
- Unauthenticated Fleet Access, Message Disclosure, and Node Identity Spoofing<![CDATA[ ## Vulnerability Details **File Location**: `fleet_bus.js:133-174` **Vulnerability Type**: Missing authentication and authorization **Risk Level**: High ### Vulnerable Code ```js if (m === 'GET' && p === '/all') { return send(res, 200, allMsgs(100)); } if (m === 'GET' && p === '/status') { const total = fs.existsSync(MSG_FILE) ? fs.readFileSync(MSG_FILE,'utf8').trim().split('\n').filter(Boolean).length : 0; return send(res, 200, { status:'ok', port:PORT, total, nodes:Object.keys(knownNodes), uptime: process.uptime()|0 }); } if (m === 'GET' && p === '/nodes') return send(res, 200, knownNodes); if (m === 'GET' && p === '/messages') { const node = parsed.searchParams.get('node') || '00'; const since = parseInt(parsed.searchParams.get('since') || '0'); return send(res, 200, readMsgs(node, since)); } if (m === 'POST' && p === '/register') { return getBody(req, (e, data) => { if (e) return send(res, 400, { error: e.message }); regNode(data.nodeId, { ip: req.socket.remoteAddress, ...data }); send(res, 200, { ok:true, nodes: Object.keys(knownNodes) }); }); } if (m === 'POST' && p === '/send') { return getBody(req, (e, msg) => { if (e) return send(res, 400, { error: e.message }); if (!msg.from || !msg.to || !msg.msg) return send(res, 400, { error:'need from,to,msg' }); regNode(msg.from, { lastAction:'send' }); send(res, 200, { ok:true, entry: appendMsg(msg) }); }); } if (m === 'POST' && p === '/broadcast') { return getBody(req, (e, msg) => { if (e) return send(res, 400, { error: e.message }); msg.to = 'all'; if (!msg.from || !msg.msg) return send(res, 400, { error:'need from,msg' }); regNode(msg.from, { lastAction:'broadcast' }); send(res, 200, { ok:true, entry: appendMsg(msg) }); }); } send(res, 404, { error:'not found' }); }); server.listen(PORT, '0.0.0.0', () => console.log('🚌 Fleet Bus v1.1 on :' + PORT)); ``` ### Technical Analysis The message bus listens on every available net ...[truncated 2810 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Bind to `127.0.0.1` by default and require an explicit secure configuration to expose the service remotely. 2. Require authenticated transport, preferably mutual TLS for machine-to-machine communication. 3. Alternatively, require short-lived signed tokens with explicit node identity and permitted operations. 4. Derive the sender identity from the authenticated connection or token. Never trust `from` or `nodeId` supplied by the caller. 5. Apply endpoint-level authorization: - Only authorized coordinators should broadcast. - Nodes should only read messages addressed to their authenticated identity. - Remove or strictly restrict `/all`. - Prevent callers from replacing another node's registration. 6. Cryptographically sign messages and verify signatures before presenting them as trusted instructions. 7. Add replay protection through nonces, timestamps, and bounded validity periods. 8. Restrict port 18800 using host firewall rules and network access-control lists. 9. Log failed authentication, identity conflicts, and unusual message activity without logging sensitive message bodies unnecessarily. 10. Document that received message text must be treated as untrusted input and must not directly authorize tool or shell execution. ]]>