T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- references/examples.md:936
- Finding
- Missing Authentication and Authorization on Financial Operations and Reporting Endpoints<![CDATA[ ## Vulnerability Details **File Location**: `references/examples.md:936-955, 1002-1035` **Vulnerability Type**: Missing authentication, authorization, and tenant isolation **Risk Level**: High ### Vulnerable Code ```typescript async handlePayment(req: Request, res: Response, next: NextFunction) { try { // Rate limiting const clientId = req.ip || 'unknown'; if (!await this.rateLimiter.checkLimit(clientId)) { return res.status(429).json({ error: 'Too many requests', }); } // Process payment const result = await this.processor.processPayment(req.body); if (result.success) { res.status(200).json(result); } else { res.status(400).json(result); } } catch (error: any) { auditLogger.error('Payment API error', { error: error.message, stack: error.stack, }); res.status(500).json({ error: 'Internal server error', reference: Date.now(), }); } } async handleReconciliation(req: Request, res: Response) { try { const { startDate, endDate } = req.query; const result = await this.reconciliation.reconcileTransactions( new Date(startDate as string), new Date(endDate as string) ); res.status(200).json(result); } catch (error: any) { res.status(500).json({ error: error.message, }); } } async handleComplianceReport(req: Request, res: Response) { try { const { type, startDate, endDate } = req.query; const report = await this.compliance.generateRegulatoryReport( type as string, { start: new Date(startDate as string), end: new Date(endDate as string), } ); res.status(200).json(report); } catch (error: any) { res.status(500).json({ ...[truncated 2099 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require authentication middleware on every payment, reconciliation, and compliance route. 2. Apply explicit role-based or attribute-based authorization: - Restrict payment initiation to authorized account owners or payment operators. - Restrict reconciliation reports to finance personnel. - Restrict regulatory reports to designated compliance roles. 3. Enforce tenant and account boundaries in every database query rather than filtering only after retrieval. 4. Verify server-side ownership of customer IDs, Stripe customer IDs, and payment-method IDs. 5. Use narrowly scoped service credentials and separate credentials for payment, reporting, and administrative operations. 6. Restrict report date ranges and permitted report types, and validate all query parameters. 7. Add authorization-denial tests covering anonymous users, cross-tenant access, and insufficient roles. 8. Retain rate limiting as defense in depth, but do not treat it as authentication or authorization. ]]>