T09 · Insecure Skill Coding Practices
Error
- Location
bridge-server.js:325- Finding
Unauthenticated Local API Permits Privileged Minecraft Bot Control
- Content
View full analysis
{ if (req.method === 'OPTIONS') { res.writeHead(204); res.end(); return; } let body = ''; let bodyBytes = 0; req.on('data', c => { bodyBytes += c.length; if (bodyBytes > MAX_BODY_BYTES) { json(res, 413, { success: false, error: 'Request body too large' }); req.destroy(); return; } body += c; }); req.on('end', async () => { const url = req.url.split('?')[0]; const qs = Object.fromEntries(new URLSearchParams(req.url.split('?')[1] || '')); const key = `${req.method} ${url}`; const handler = handlers[key]; if (!handler) { json(res, 404, { error: 'Unknown route', available: Object.keys(handlers) }); return; } if (key !== 'GET /status' && !requireConnected(res)) return; try { const parsed = body ? JSON.parse(body) : {}; const result = await handler(parsed, qs); json(res, 200, { success: true, ...result }); } catch (err) { console.error(`[bridge] ${key} error:`, err.message); json(res, 500, { success: false, error: err.message }); } }); }); server.listen(CFG.bridge.port, '127.0.0.1', () => { ``` ### Technical Analysis The HTTP server dispatches requests solely according to the HTTP method and path. It does not require an authentication token, validate caller identity, or perform authorization checks for high-impact endpoints. Binding to `127.0.0.1` reduces direct remote exposure but is not an authentication boundary. Any process running in the same network namespace can access the API. The service may also become reachable through local proxies, port forwarding, browser-to-localhost attack techniques, or server-side request forgery in another local application. The exposed ...[truncated 1204 chars]- Remediation
View remediation
` header on every endpoint, including state-reading endpoints where confidentiality matters. 3. Compare credentials using a timing-safe operation. 4. Store the token in a user-private file with mode `0600`, preferably below a directory with mode `0700`. 5. Return HTTP 401 for missing or invalid credentials and HTTP 403 for unauthorized operations. 6. Separate read-only and action privileges if multiple clients need access. 7. Continue binding exclusively to loopback and explicitly reject non-loopback clients. 8. Document that reverse proxies, container port publication, SSH forwarding, and public exposure require an additional authenticated security layer. 9. Run the Minecraft bot with the minimum server permissions required for its intended tasks. ]]>