T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/orchestrator.py:236
- Finding
- Unauthenticated endpoints can consume privileged third-party services and persistent storage<![CDATA[ ## Vulnerability Details **File Location**: `scripts/orchestrator.py:236-257` and `scripts/orchestrator.py:267-459` **Vulnerability Type**: Missing authentication, authorization, rate limiting, and resource controls **Risk Level**: High ### Vulnerable Code ```python @router.post("/api/agent/chat") async def agent_chat(req: AgentRequest): """Direct chat with any Mistral Agent via Conversations API.""" if not MISTRAL_API_KEY: raise HTTPException(status_code=500, detail="MISTRAL_API_KEY not set") client = Mistral(api_key=MISTRAL_API_KEY) _setup_handoff_agents(client) agent_id = AGENTS.get(req.agent) # Use stable pre-registered agents if not agent_id: raise HTTPException(status_code=400, detail=f"Unknown agent: {req.agent}") if req.conversation_id: response = client.beta.conversations.append( conversation_id=req.conversation_id, inputs=req.message ) conv_id = req.conversation_id else: response = client.beta.conversations.start( agent_id=agent_id, inputs=req.message ) conv_id = response.conversation_id return { "response": _extract_text(response), "conversation_id": conv_id, "agent": req.agent, "tool": "mistral_conversations_api" } ``` ```python @router.post("/api/orchestrate") async def orchestrate_story(req: OrchestrateRequest): cached = await prompt_cache.get_cached( req.prompt, req.child_name, req.language ) if cached: return { "id": cached.get("id", 0), "title": cached.get("title"), "scenes": cached.get("scenes", []), "mood": cached.get("mood", "magical"), "language": req.language, "child_name": req.child_name, "orchestration": {"source": "prompt_cache"}, "agents_used": ["cache_hit"], "tool": "prompt_cache", "cached": ...[truncated 3928 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require strong authentication on both POST endpoints before performing cache lookups, agent creation, or provider calls. 2. Enforce per-user authorization and ensure callers may access only their own conversations and stored stories. 3. Add per-user and per-IP rate limits, daily quotas, and provider-cost budgets. 4. Define Pydantic field constraints for prompt, message, name, language, conversation ID, and voice ID lengths. 5. Limit the number and duration of generated media assets per request. 6. Add global concurrency limits and bounded provider timeouts. 7. Move `_setup_handoff_agents()` into a separate authenticated administrative provisioning process or deployment step. 8. Reject arbitrary conversation continuation unless the conversation is mapped to and owned by the authenticated user. 9. Apply database storage quotas, retention policies, and cleanup procedures. 10. Monitor anomalous usage and log authenticated account identifiers, request costs, provider failures, and quota decisions. 11. Ensure authentication is enforced at the application layer even if a reverse proxy or API gateway also provides access control. ]]>