T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/gateway-handlers.js:73- Finding
Unauthenticated State-Changing HTTP API with Wildcard CORS
- Content
View full analysis
createProject(body), "GET /api/projects": (body) => listProjects(body), "GET /api/projects/:id": (body) => getProject(body.id), "PATCH /api/projects/:id": (body) => updateProject(body.id, body), "DELETE /api/projects/:id": (body) => deleteProject(body.id), "POST /api/phases": (body) => addPhase(body.projectId, body), "POST /api/tasks": (body) => addTask(body.projectId, body.phaseId, body), "PATCH /api/tasks/:id": (body) => updateTask(body.projectId, body.id, body), "GET /api/tasks": (body) => listTasks(body.projectId, body), "POST /api/comments": (body) => addComment(body.projectId, body.taskId, body), "POST /api/chat": (body) => appendChatMessage(body.projectId, body), "GET /api/chat": (body) => getChatHistory(body.projectId, body), "GET /api/stats": (body) => getProjectStats(body.projectId), "GET /api/wbs": (body) => getWBS(body.projectId), "GET /api/dispatch/plan": (body) => getDispatchPlan(body.projectId), "GET /api/dispatch/ready": (body) => findReadyTasks(body.projectId), "POST /api/dispatch/advance": (body) => advancePhases(body.projectId), }; const server = http.createServer(async (req, res) => { res.setHeader("Content-Type", "application/json"); res.setHeader("Access-Control-Allow-Origin", "*"); res.setHeader("Access-Control-Allow-Methods", "GET, POST, PATCH, DELETE, OPTIONS"); res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization"); if (req.method === "OPTIONS") { res.writeHead(200); res.end(); return; } ``` ### Technical Analysis When `TEAM_PROJECTS_PORT` is set to a positiv ...[truncated 2053 chars]- Remediation
View remediation