T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/rag-service.mjs:181
- Finding
- Unauthenticated Arbitrary-Directory Document Ingestion<![CDATA[ ## Vulnerability Details **File Location**: `scripts/rag-service.mjs:64-76`, `scripts/rag-service.mjs:122-128`, and `scripts/rag-service.mjs:181-187` **Vulnerability Type**: Missing authentication and unrestricted filesystem path access **Risk Level**: High when non-loopback binding is enabled; Medium with the default loopback binding ### Vulnerable Code ```js function listTextFiles(dir) { if (!fs.existsSync(dir)) return []; const out = []; const stack = [path.resolve(dir)]; while (stack.length) { const cur = stack.pop(); for (const ent of fs.readdirSync(cur, { withFileTypes: true })) { const p = path.join(cur, ent.name); if (ent.isDirectory()) stack.push(p); else if (/\.(txt|md)$/i.test(ent.name)) out.push(p); } } return out; } ``` ```js async function ingestFromDir(dir, reset = true) { const files = listTextFiles(dir); if (!files.length) return { files: 0, chunks: 0 }; const rows = []; for (const f of files) { const text = fs.readFileSync(f, 'utf8'); ``` ```js if (req.method === 'POST' && req.url === '/ingest') { const body = await readJsonBody(req); const dir = body.dir || './docs'; const reset = body.reset !== false; const out = await ingestFromDir(dir, reset); return json(res, 200, { ok: true, ...out, model: MODEL, dbPath: DB_PATH }); } ``` ### Technical Analysis The `/ingest` endpoint accepts a caller-controlled directory without authentication, authorization, or validation against an approved ingestion root. `path.resolve(dir)` permits absolute paths and traversal expressions to resolve anywhere on the local filesystem. The service then recursively enumerates the selected directory and reads every `.txt` or `.md` file accessible to the service process. The documents are embedded and stored with their original text and source path. The unauthenticated `/search` endpoint can subsequently return indexed text. The default loopback-only listener reduces network exposure, but any ...[truncated 2051 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require authentication and authorization for `/ingest` and `/search`, especially before allowing non-loopback binding. 2. Define one or more explicit ingestion roots in trusted server-side configuration. Do not let clients select arbitrary filesystem locations. 3. Canonicalize both the approved root and requested path using `fs.realpathSync()` and reject requests whose canonical path is not the approved root or one of its descendants. 4. Reject symbolic links or validate every traversed file's canonical path to prevent escapes from the approved root. 5. Run the service under a dedicated, least-privileged account with access only to intended document and database directories. 6. Consider separating ingestion administration from search access. Ingestion should normally require stronger privileges than querying. 7. Keep loopback binding mandatory unless authentication, transport security, and network access controls have been configured. 8. Avoid returning internal database and source paths unless clients explicitly require them. 9. Add security tests for absolute paths, `..` traversal, symbolic-link escapes, unauthenticated requests, and non-loopback deployment. ]]>