T09 · Insecure Skill Coding Practices
Error
- Location
references/backend.md:84- Finding
Authenticated Users Can Submit Statistics for Other Players
- Content
View full analysis
{ const { miniplay_id, stats } = req.body; // MINIPLAY_API_KEY authorizes server-to-server write calls const signature = createHmac('sha256', process.env.MINIPLAY_API_KEY) .update(`${miniplay_id}:${stats.kills}:${stats.plays}`) .digest('hex'); // Example: push stats to Minijuegos server-side endpoint await fetch(`https://api.minijuegos.com/lechuck/server/user/${miniplay_id}/stats/`, { method: 'POST', headers: { 'Content-Type': 'application/json', 'X-Api-Id': process.env.MINIPLAY_API_ID, 'X-Api-Key': process.env.MINIPLAY_API_KEY, 'X-Signature': signature, }, body: JSON.stringify(stats), }); res.json({ ok: true }); }); ``` ### Technical Analysis The route requires authentication, but it takes the target `miniplay_id` directly from the client-controlled request body. It does not verify that this identifier belongs to the authenticated session. Consequently, possession of any valid account session may be sufficient to make the backend issue privileged, server-signed statistics updates for another Minijuegos user. The server attaches `MINIPLAY_API_KEY` and a generated HMAC to the outbound request, converting an otherwise untrusted client request into an authorized provider request. The `stats` object is also forwarded without schema, range, or semantic validation. Depending on the provider's validation, an attacker may submit fabricated, negative, excessively large, or unexpected values. ### Attack Path 1. The attacker authenticates through the normal Minijuegos flow and receives a valid application session. 2. The attacker obtains or guesses another p ...[truncated 978 chars]- Remediation
View remediation