T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- listener.py:43
- Finding
- Authentication Is Optional on a Service Bound to All Network Interfaces## Vulnerability Details **File Location**: `listener.py:43-47`, `listener.py:92-112`, `listener.py:716-728` **Vulnerability Type**: Missing authentication and overly broad network exposure **Risk Level**: High ### Vulnerable Code ```python API_SECRET = os.environ.get("BRIDGE_SECRET", "") PORT = int(os.environ.get("BRIDGE_PORT", 5000)) DRY_RUN = os.environ.get("DRY_RUN", "").strip() == "1" _raw_ips = os.environ.get("BRIDGE_ALLOWED_IPS", "172.0.0.0/8,127.0.0.1,::1") ``` ```python def require_auth(f): """IP allowlist + optional shared-secret check.""" @wraps(f) def wrapper(*args, **kwargs): client_ip = request.remote_addr or "" try: addr = ipaddress.ip_address(client_ip) allowed = any(addr in net for net in ALLOWED_NETWORKS) except ValueError: allowed = False if not allowed: log.warning("Rejected %s — not in IP allowlist", client_ip) return jsonify({"error": "Forbidden"}), 403 if API_SECRET and request.headers.get("X-Bridge-Secret") != API_SECRET: log.warning("Rejected %s — bad or missing X-Bridge-Secret", client_ip) return jsonify({"error": "Unauthorized"}), 401 return f(*args, **kwargs) return wrapper ``` ```python if API_SECRET: log.info("🔒 Auth : X-Bridge-Secret required") else: log.warning("⚠️ Auth : No BRIDGE_SECRET — anyone on allowed IPs can call this API") app.run(host="0.0.0.0", port=PORT, debug=False) ``` ### Technical Analysis The Flask application binds to `0.0.0.0`, making it available through every network interface. Authentication is only checked when `BRIDGE_SECRET` is nonempty. Consequently, the default configuration provides no credential-based authentication. The IP allowlist is the only access control under the default configuration, and it trusts the entire `172.0.0.0/8` address range. This is significantly broader than a single int ...[truncated 2273 chars]
- Remediation
- ## Remediation Suggestions 1. Require `BRIDGE_SECRET` at startup and terminate with an error if it is absent outside an explicitly enabled development mode. 2. Compare submitted secrets using `hmac.compare_digest` rather than ordinary string inequality. 3. Bind the service to the narrowest usable interface instead of `0.0.0.0`. 4. Replace the default `172.0.0.0/8` rule with the exact Docker subnet or specific source addresses required by the intended agent. 5. Reject an empty or entirely invalid `BRIDGE_ALLOWED_IPS` configuration instead of silently continuing. 6. Add separate authorization controls for read and destructive operations where practical. 7. Require explicit confirmation or stable reminder identifiers for broad fuzzy update and deletion operations. 8. Add rate limiting and security event logging for rejected and destructive requests. 9. Update the documentation so unauthenticated operation is described only as an isolated development option, not a normal deployment mode.