T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- src/main.py:29
- Finding
- Missing Authentication Across Sensitive and State-Changing APIs<![CDATA[ ## Vulnerability Details **File Location**: `src/main.py:29-38`, `src/core/auth.py:15-39` **Vulnerability Type**: Missing authentication and fail-open authorization **Risk Level**: Critical ### Vulnerable Code ```python app.include_router(health.router, prefix="/api/v1", tags=["health"]) app.include_router(intent.router, prefix="/api/v1", tags=["intent"]) app.include_router(scenes.router, prefix="/api/v1", tags=["scenes"]) app.include_router(insights.router, prefix="/api/v1", tags=["insights"]) app.include_router(suggestions.router, prefix="/api/v1", tags=["suggestions"]) app.include_router(dashboard.router, prefix="/api/v1", tags=["dashboard"]) app.include_router(apply.router, prefix="/api/v1", tags=["apply"]) app.include_router(devices.router, prefix="/api/v1", tags=["devices"]) app.include_router(semantic.router, prefix="/api/v1", tags=["semantic"]) app.include_router(insights2.router, prefix="/api/v1", tags=["insights2"]) ``` ```python async def verify_api_key(api_key: str = Security(api_key_header)) -> str: """验证 API Key""" # 如果没配置 API Key，跳过验证 if not API_KEY: return "dev" # 验证 if not api_key: raise HTTPException( status_code=401, detail="请提供 API Key" ) if api_key != API_KEY: raise HTTPException( status_code=403, detail="API Key 无效" ) return api_key def require_auth(): """认证依赖""" return Depends(verify_api_key) ``` ### Technical Analysis An API-key verification function exists, but none of the application routers or individual endpoints apply `require_auth()` or `verify_api_key`. Consequently, every route is accessible without authentication. The authentication implementation also fails open when `WORKSWITH_CLAW_API_KEY` is empty. This is particularly dangerous because the documented launch command binds the application to `0.0.0.0`, and the Docker configuration leaves the API key empty while using host ...[truncated 1267 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Apply authentication globally to all routes except a deliberately minimal health endpoint. - Configure router dependencies, for example: ```python app.include_router( devices.router, prefix="/api/v1", dependencies=[Depends(verify_api_key)] ) ``` - Fail closed during startup if no API key or equivalent authentication mechanism is configured. - Use constant-time secret comparison with `secrets.compare_digest`. - Introduce authorization roles separating read-only monitoring from device control and automation management. - Bind to `127.0.0.1` by default and require an explicit setting for network-wide exposure. - Place the service behind an authenticated HTTPS reverse proxy. - Add request rate limiting, security logging, and CSRF protection if browser sessions are introduced. - Remove `network_mode: host` unless it is strictly required. ]]>