T09 · Insecure Skill Coding Practices
- Location
scripts/risk_diff.py:319- Finding
Weak and Intentionally Bypassable Premium License Validation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/risk_diff.py, lines 319–343
Vulnerability Type: Weak authorization and license verification
Risk Level: Mediumpython # Replace with your Gumroad/LemonSqueezy verify endpoint in production. # For now, accept any key listed here OR any key whose SHA-256 prefix matches. _VALID_LICENSE_PREFIXES = { # SHA-256(b"DEMO-FOR-OPERATOR")[:8] — operator bypass. "9b2d6fb1", # SHA-256(b"EDGARRISK-NOVELTY-2026-A4G7")[:8] — production v1 key (Gumroad). "bc4c1307", } def license_active() -> bool: key = "" if "EDGAR_RISK_LICENSE" in os.environ: key = os.environ["EDGAR_RISK_LICENSE"].strip() elif LICENSE_PATH.exists(): key = LICENSE_PATH.read_text(encoding="utf-8").strip() if not key: return False digest = hashlib.sha256(key.encode()).hexdigest()[:8] return digest in _VALID_LICENSE_PREFIXES def require_license(feature: str) -> None: if license_active(): returnTechnical Analysis
License validation compares only the first eight hexadecimal characters of a SHA-256 digest. This reduces the effective verification space to 32 bits rather than relying on the full cryptographic digest or a digital signature. Because both accepted prefixes are embedded in publicly readable source code, an attacker can generate arbitrary candidate strings offline until one produces a matching prefix.
The code also explicitly includes an operator-bypass prefix, creating an alternate entitlement path in the distributed application. Although the corresponding plaintext key is shown only in a comment as the hash input description, the presence of a bypass mechanism further undermines the authorization boundary.
This issue does not enable operating-system privilege escalation, code execution, credential access, or data exfiltration. It is an application-level authorization weakness affecting the premium feature gate.
Attack Path
- Inspect `scripts/ ...[truncated 949 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace truncated-hash comparison with cryptographically signed offline licenses. Sign entitlement data with a vendor-controlled private key and verify the complete signature using an embedded public key.
- If online verification is acceptable, validate licenses through an authenticated HTTPS vendor endpoint and verify the response securely.
- Remove the operator-bypass value and all alternate production authorization paths from distributed code.
- Do not treat an unsalted hash or hash prefix as proof that a license was issued by the vendor.
- Bind licenses to explicit entitlement metadata, such as product, enabled feature, expiration date, and license identifier, and include all metadata in the signed payload.
- Fail closed on malformed licenses, invalid signatures, expired entitlements, and verification errors.
- Add automated tests confirming that arbitrary values and prefix collisions cannot activate premium functionality.