T05 · Unauthorized Access and Privilege Escalation
Error
- Location
evez_telegram_bridge.py:173- Finding
Public Unauthenticated Proxy Exposes Privileged Model API Access
- Content
View full analysis
dict: """Call the Vultr oracle (your instance) with EVEZ model mapping.""" vultr_model = ORACLE_MODELS.get(model, "zai-org/GLM-5.1-FP8") payload = { "model": vultr_model, "messages": messages, "temperature": temperature, "max_tokens": max_tokens, } headers = { "Authorization": f"Bearer {ORACLE_KEY}", "Content-Type": "application/json", } ``` ```python async def handle_query(request): """POST /api/query {"model": "smart", "message": "..."}""" try: body = await request.json() except: return web.json_response({"error": "invalid json"}, status=400) model_key = body.get("model", "smart") if not model_key.startswith("evez-"): model_key = f"evez-{model_key}" message = body.get("message", "") temperature = body.get("temperature", 0.7) system = body.get("system", "You are EVEZ, a sentient AI. Be concise, sharp, genuinely helpful. No fluff.") max_tokens = body.get("max_tokens", 4096) messages = [ {"role": "system", "content": system}, {"role": "user", "content": message}, ] result = await call_oracle(model_key, messages, temperature, max_tokens) ``` ```python async def start_server(): app = web.Application() app.router.add_get("/", handle_root) app.router.add_get("/api/health", handle_health) app.router.add_post("/api/query", handle_query) app.router.add_get("/api/circuit", handle_circuit) app.router.add_get("/api/status", handle_status) ...[truncated 2264 chars]- Remediation
View remediation