T05 · Unauthorized Access and Privilege Escalation
Error
- Location
kvstore/app.py:29- Finding
Unauthenticated Access to Stored Data and Destructive Operations
- Content
View full analysis
Vulnerability Details
File Location:
kvstore/app.py:29-65
Vulnerability Type: Missing authentication and authorization
Risk Level: HighVulnerable Code
python @app.post("/v1/set", response_model=SetResponse) async def set_value(request: SetRequest) -> SetResponse: set_key(request.key, request.value, request.ttl_seconds) return SetResponse(key=request.key, stored=True) @app.get("/v1/get/{key}", response_model=GetResponse) async def get_value(key: str) -> GetResponse: entry = get_key(key) if entry is None: raise HTTPException(status_code=404, detail=f"Key not found: {key}") return GetResponse(key=entry.key, value=entry.value, ttl_remaining=entry.ttl_remaining) @app.delete("/v1/delete/{key}", response_model=DeleteResponse) async def delete_value(key: str) -> DeleteResponse: deleted = delete_key(key) if not deleted: raise HTTPException(status_code=404, detail=f"Key not found: {key}") return DeleteResponse(key=key, deleted=True) @app.get("/v1/keys", response_model=KeyListResponse) async def get_keys(prefix: str | None = Query(default=None)) -> KeyListResponse: keys = list_keys(prefix) return KeyListResponse(keys=keys, total=len(keys)) @app.post("/v1/flush", response_model=FlushResponse) async def flush() -> FlushResponse: count = flush_all() return FlushResponse(deleted=count)Technical Analysis
All data-management routes are exposed without an authentication dependency, authorization check, API key, or client-specific namespace. A client that can reach the service can enumerate key names, retrieve arbitrary values, overwrite entries, delete selected entries, or erase the entire store.
This is especially relevant because the documented use case includes agent state, shared pipeline data, and token-like cached values. Although the documented Uvicorn command normally binds to the loopback interfac ...[truncated 1462 chars]
- Remediation
View remediation
Remediation Suggestions
- Require authentication on every endpoint using a centrally applied FastAPI dependency or authentication middleware.
- Enforce authorization separately for read, write, delete, enumeration, statistics, and global-flush operations.
- Assign each client or agent an isolated namespace and verify ownership before reading or modifying a key.
- Restrict
/v1/flushto a dedicated administrative role and consider disabling it in production. - Bind the service explicitly to a trusted interface and enforce host firewall or service-mesh access controls.
- Use TLS when requests can cross an untrusted network.
- Avoid storing credentials or tokens in plaintext. If sensitive values must be stored, encrypt them and tightly restrict decryption access.
- Add audit logging for reads, writes, deletes, failed authorization attempts, and global administrative actions.
- Return generic not-found responses where appropriate to reduce key-discovery signals.