T05 · Unauthorized Access and Privilege Escalation
Error
- Location
server.js:39- Finding
Unauthenticated Network Query Endpoint Exposes Contact Data and Paid AI Operations
- Content
View full analysis
{ try { const { query, sessionId } = req.body || {}; if (!query || typeof query !== 'string' || !sessionId || typeof sessionId !== 'string') { return res.status(400).json({ error: 'Both query and sessionId are required strings.', }); } const cachedContext = await getQueryContext(sessionId); if (cachedContext && cachedContext.query === query) { return res.json({ results: cachedContext.results || [], }); } const connections = await getAllConnections(); const scoredConnections = await scoreConnections(query, connections); const topResults = await Promise.all( scoredConnections.slice(0, 5).map(async (connection) => { let actions = []; try { actions = await suggestActions(connection); } catch { actions = ['Draft intro email', 'Send quick follow-up']; } return { name: connection.name, role: connection.role, company: connection.company, platforms: connection.platforms, relevanceScore: connection.relevanceScore, reason: connection.reason, suggestedActions: actions, }; }) ); await saveQueryContext(sessionId, { query, results: topResults, createdAt: new Date().toISOString(), }); return res.json({ results: topResults }); } catch (error) { console.error('Query handling failed:', error); return res.status(500).json({ error: 'Unable to process query right now. Please try again.', }); } }); ``` ### Technical Analysis The `/api/query` route performs no authentication or authorization before loading the complete Redis-backed conne ...[truncated 2421 chars]- Remediation
View remediation