T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/backend-endpoint.js:10- Finding
Unauthenticated Network-Accessible Screen Frame Injection
- Content
View full analysis
{ body += chunk; }); req.on('end', () => { try { const { frame, timestamp, width, height } = JSON.parse(body); const buffer = Buffer.from(frame, 'base64'); fs.writeFileSync(FRAME_PATH, buffer); fs.writeFileSync(META_PATH, JSON.stringify({ timestamp, width, height, active: true, updated: new Date().toISOString() })); res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ status: 'ok' })); } catch (err) { res.writeHead(400); res.end(JSON.stringify({ error: err.message })); } }); return; } ``` ```javascript server.listen(PORT, () => { console.log('Screen share server: http://localhost:' + PORT + '/screen-share'); }); ``` ### Technical Analysis The screen-frame upload endpoint has no authentication or session authorization. Any client able to reach TCP port 18795 can submit arbitrary Base64 data and replace the frame used by the analysis workflow. Calling `server.listen(PORT)` without specifying a hostname normally binds Node.js to an unspecified address, potentially exposing the service through available network interfaces rather than limiting it to loopback. The log message claims a localhost URL but does not enforce a localhost-only binding. The wildcard `Access-Control-Allow-Origin: *` ...[truncated 2044 chars]- Remediation
View remediation
{ console.log(`Screen share server: http://127.0.0.1:${PORT}/screen-share`); }); ``` 2. Generate a cryptographically random, per-session token and require it for both the portal and frame-upload endpoint. 3. Reject uploads when the token is missing, expired, or does not belong to the active sharing session. 4. Replace wildcard CORS with an exact allowlist. If the portal is served from the same origin, omit CORS entirely. 5. Validate the `Origin` header as defense in depth, while not treating it as the sole authentication mechanism. 6. End the authenticated session when screen sharing stops and delete the corresponding stored frame. 7. Clearly document any intentional non-loopback exposure and recommend host firewall restrictions. 8. Treat screen images as untrusted Agent input and prevent visual content from overriding system or developer instructions. ]]>