T05 · Unauthorized Access and Privilege Escalation
Error
- Location
platform/server.py:340- Finding
Unauthenticated REST API Permits Persistent Memory Disclosure and Poisoning
- Content
View full analysis
bool: """If a Bearer Token is configured, verify the request header; otherwise allow it.""" if not _BEARER_TOKEN: return True auth = self.headers.get("Authorization", "") if auth.startswith("Bearer ") and auth[7:] == _BEARER_TOKEN: return True self._send_json(401, {"error": "Unauthorized: valid Bearer Token required"}) return False def _send_json(self, status: int, data: dict): body = json.dumps(data, ensure_ascii=False, indent=2).encode("utf-8") self.send_response(status) self.send_header("Content-Type", "application/json; charset=utf-8") self.send_header("Content-Length", str(len(body))) # CORS: permit local web clients self.send_header("Access-Control-Allow-Origin", "*") self.send_header("Access-Control-Allow-Methods", "GET, POST, OPTIONS") self.send_header("Access-Control-Allow-Headers", "Content-Type") self.end_headers() self.wfile.write(body) ``` The profile endpoint exposes and modifies persistent user information: ```python def tool_memory_profile(body: dict) -> tuple[bool, str]: action = body.get("action", "read") profile_file = ULTRA_MEMORY_HOME / "semantic" / "user_profile.json" if action == "read": try: content = profile_file.read_text(encoding="utf-8") return True, content except FileNotFoundError: return True, "{}" elif action == "update": profile = {} if profile_file.exists(): try: profile = json.loads(profile_file.read_text(encoding="utf-8")) except Exception: ...[truncated 2989 chars]- Remediation
View remediation