T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/dashboard.js:27- Finding
Unauthenticated Dashboard Exposes Stored Social-Media Credentials
- Content
View full analysis
scheduledFor) const normalize = posts => posts.map(p => ({ ...p, scheduledFor: p.scheduledTime || p.scheduledFor })); res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ pending: normalize(pending).sort((a, b) => new Date(a.scheduledFor) - new Date(b.scheduledFor)), completed: normalize(completed).slice(-20).reverse(), failed: normalize(failed).slice(-10).reverse() })); } catch (err) { res.writeHead(500, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ error: err.message })); } } ``` ```javascript // Enable CORS for local development res.setHeader('Access-Control-Allow-Origin', '*'); res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS'); res.setHeader('Access-Control-Allow-Headers', 'Content-Type'); ``` ```javascript server.listen(PORT, () => { console.log(`\n🎨 Social Scheduler Dashboard\n`); console.log(` 📡 Server running at: http://localhost:${PORT}`); console.log(` 🌐 Open in browser to manage scheduled posts\n`); console.log(` Press Ctrl+C to stop\n`); }); ``` ### Technical Analysis Queue records contain the complete `config` value used to authenticate to each platform. Depending on the platform, this can include OAuth access tokens, account passwords, API secrets, bot tokens, or Discord webhook URLs. The `normalize` function cop ...[truncated 2130 chars]- Remediation
View remediation
posts.map(({ config, result, ...post }) => ({ ...post, scheduledFor: post.scheduledTime || post.scheduledFor })); ``` 2. Bind the dashboard explicitly to loopback: ```javascript server.listen(PORT, '127.0.0.1', () => { // ... }); ``` 3. Require authentication for every dashboard and API route. Use a randomly generated, securely stored session secret or local access token. 4. Replace wildcard CORS with a strict allowlist. If the frontend is served from the same origin, omit CORS entirely. 5. Add CSRF protection and validate the `Origin` and `Host` headers for state-changing routes. 6. Never return credentials in error objects, post results, analytics, or completed queue records. 7. Rotate all platform credentials that may previously have been exposed through this endpoint. ]]>