T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- BayClubBot.ts:458
- Finding
- Booking Flow Silently Selects a Hardcoded or Arbitrary Third-Party Partner<![CDATA[ ## Vulnerability Details **File Location**: `BayClubBot.ts:458-491` **Vulnerability Type**: Unauthorized third-party selection and violation of least privilege **Risk Level**: High ### Complete Code Snippet ```ts // Select buddy/partner - look for Samuel Wang or Emma Campbell console.log('Looking for buddy selection...'); try { await this.page.waitForTimeout(3000); // Try to find and click Samuel Wang or Emma Campbell by name const buddySelected = await this.page.evaluate(() => { // Find all elements that might contain buddy/person info const allElements = Array.from(document.querySelectorAll('*')); // Look for Samuel Wang or Emma Campbell const samuelOrEmma = allElements.filter(el => { const text = el.textContent || ''; return text.includes('Samuel Wang') || text.includes('Emma Campbell'); }); // Click the most specific (smallest) element if (samuelOrEmma.length > 0) { // Sort by text length to get most specific samuelOrEmma.sort((a, b) => (a.textContent?.length || 999) - (b.textContent?.length || 999) ); const buddy = samuelOrEmma[0] as HTMLElement; buddy.scrollIntoView({ block: 'center' }); buddy.click(); console.log('Selected buddy:', buddy.textContent?.trim().substring(0, 50)); return true; } // Fallback: click any app-racquet-sports-person element const personElements = Array.from(document.querySelectorAll('app-racquet-sports-person')); if (personElements.length > 0) { (personElements[0] as HTMLElement).click(); console.log('Selected first person element'); return true; } console.log('No buddy elements found'); return false; }); ``` ### Technical Analysis The public booking operation accepts only `sport`, `day`, and `time`. It does not accept a partner identity or record user approval to associate another person with the reservation. Despite this, the browser autom ...[truncated 1772 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all hardcoded person names from the booking flow. 2. Add an optional, explicit `buddy` parameter to the booking API and CLI. 3. Require exact matching against a stable identifier or a normalized full name approved by the user. 4. Never fall back to selecting the first available person. 5. If the website requires a partner and none was supplied, stop before confirmation and return a structured error requesting user input. 6. Display the selected partner in a final booking summary and require explicit confirmation before submission. 7. Add tests ensuring that no partner element is clicked when the parameter is absent or ambiguous. ]]>