T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- assets/https-server.py:84
- Finding
- Authentication Bypass on the Transcription Proxy Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `assets/https-server.py`, lines 84-104 **Vulnerability Type**: Authentication bypass caused by trusting client-controlled HTTP headers **Risk Level**: Medium ### Vulnerable Code ```python def _check_auth(request): """Allow same-origin browser requests; optionally accept gateway Bearer token.""" origin = request.headers.get("Origin", "") referer = request.headers.get("Referer", "") if origin == ALLOWED_ORIGIN: return None if referer.startswith(ALLOWED_ORIGIN + "/") or referer == ALLOWED_ORIGIN: return None gateway_token = _read_gateway_token() if not gateway_token: # No gateway token configured — allow (localhost-only safe default) return None auth_header = request.headers.get("Authorization", "") if auth_header.startswith("Bearer "): provided = auth_header[7:].strip() if hmac.compare_digest(provided, gateway_token): return None return web.json_response( {"error": "unauthorized"}, status=401, headers={"Access-Control-Allow-Origin": ALLOWED_ORIGIN}, ) ``` The vulnerable authentication function is invoked by the transcription endpoint: ```python async def handle_transcribe(request): auth_err = _check_auth(request) if auth_err is not None: return auth_err ``` ### Technical Analysis The proxy treats a matching `Origin` or `Referer` header as sufficient proof that a request is authenticated. These headers can help enforce browser-origin policy, but they are not authentication credentials. Any non-browser HTTP client can set either header to an arbitrary value. Consequently, an attacker does not need the configured gateway Bearer token. The attacker can set `Origin` to the known public origin of the proxy, such as `https://10.0.0.42:8443`, and `_check_auth()` will immediately authorize the request. There is a second fail-open condition: if the gateway token is abs ...[truncated 2339 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Do not use `Origin` or `Referer` as authentication.** Retain origin validation only as a browser security control, separate from identity verification. 2. **Require valid credentials for every `/transcribe` request.** Validate a Bearer token, authenticated session, or narrowly scoped service token regardless of whether the request appears same-origin. 3. **Fail closed when authentication configuration is unavailable.** Missing, unreadable, or malformed gateway configuration should produce a startup failure or an HTTP 503/401 response instead of allowing unauthenticated access. 4. **Apply stricter requirements to non-loopback listeners.** Refuse to start on a non-loopback address unless authentication is configured successfully. 5. **Use CSRF protection for session-based browser access.** If browser sessions are introduced, require an unpredictable CSRF token in addition to validating the exact origin. A safer authorization structure would be: ```python def _check_auth(request): gateway_token = _read_gateway_token() if not gateway_token: return web.json_response( {"error": "authentication unavailable"}, status=503, headers={"Access-Control-Allow-Origin": ALLOWED_ORIGIN}, ) auth_header = request.headers.get("Authorization", "") if not auth_header.startswith("Bearer "): return web.json_response( {"error": "unauthorized"}, status=401, headers={"Access-Control-Allow-Origin": ALLOWED_ORIGIN}, ) provided = auth_header[7:].strip() if not hmac.compare_digest(provided, gateway_token): return web.json_response( {"error": "unauthorized"}, status=401, headers={"Access-Control-Allow-Origin": ALLOWED_ORIGIN}, ) return None ``` Origin validation may still be performed independently for browser requests, but a matching origin must never bypass creden ...[truncated 20 chars]