T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/gateway-handlers.js:73
- Finding
- Unauthenticated State-Changing HTTP API with Wildcard CORS<![CDATA[ ## Vulnerability Details **File Location**: `scripts/gateway-handlers.js:73-99` **Vulnerability Type**: Missing authentication and overly permissive cross-origin access **Risk Level**: High ### Vulnerable Code ```javascript const routes = { "POST /api/projects": (body) => createProject(body), "GET /api/projects": (body) => listProjects(body), "GET /api/projects/:id": (body) => getProject(body.id), "PATCH /api/projects/:id": (body) => updateProject(body.id, body), "DELETE /api/projects/:id": (body) => deleteProject(body.id), "POST /api/phases": (body) => addPhase(body.projectId, body), "POST /api/tasks": (body) => addTask(body.projectId, body.phaseId, body), "PATCH /api/tasks/:id": (body) => updateTask(body.projectId, body.id, body), "GET /api/tasks": (body) => listTasks(body.projectId, body), "POST /api/comments": (body) => addComment(body.projectId, body.taskId, body), "POST /api/chat": (body) => appendChatMessage(body.projectId, body), "GET /api/chat": (body) => getChatHistory(body.projectId, body), "GET /api/stats": (body) => getProjectStats(body.projectId), "GET /api/wbs": (body) => getWBS(body.projectId), "GET /api/dispatch/plan": (body) => getDispatchPlan(body.projectId), "GET /api/dispatch/ready": (body) => findReadyTasks(body.projectId), "POST /api/dispatch/advance": (body) => advancePhases(body.projectId), }; const server = http.createServer(async (req, res) => { res.setHeader("Content-Type", "application/json"); res.setHeader("Access-Control-Allow-Origin", "*"); res.setHeader("Access-Control-Allow-Methods", "GET, POST, PATCH, DELETE, OPTIONS"); res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization"); if (req.method === "OPTIONS") { res.writeHead(200); res.end(); return; } ``` ### Technical Analysis When `TEAM_PROJECTS_PORT` is set to a positiv ...[truncated 2053 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require authentication on every endpoint. Generate a cryptographically random bearer token and reject requests with a missing or invalid token before route resolution. 2. Do not use wildcard CORS. Allow only the exact trusted Control UI origin and reject unexpected or absent `Origin` values where appropriate. 3. Add authorization checks for each operation, including project membership, coordinator identity, and permitted task ownership. 4. Implement explicit CSRF defenses if browser credentials or sessions are introduced. 5. Apply strict schemas to request bodies and query parameters. Reject unknown fields, invalid status values, oversized strings, and malformed arrays. 6. Enforce a small request-body limit and return HTTP `413` when exceeded. 7. Avoid returning internal exception text directly to clients; log detailed errors server-side and return generic error messages. 8. Keep the API disabled by default and clearly warn that loopback binding alone does not provide authentication. ]]>