T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/api_server.py:55- Finding
Unauthenticated Externally Reachable Bounty and Payment-Triggering API
- Content
View full analysis
Tuple[Dict[str, Any], int]: """Handle POST /bounty request.""" try: # Parse request data = request.get_json() if not data: return jsonify({ "status": "error", "message": "Request body must be JSON" }), 400 # Validate required fields required = ["raw_data", "amount_usdc", "payout_address"] missing = [f for f in required if f not in data] if missing: return jsonify({ "status": "error", "message": f"Missing required fields: {', '.join(missing)}" }), 400 raw_data = data["raw_data"] schema = data.get("schema") rules = data.get("validation_rules", "json-strict") amount_usdc = data["amount_usdc"] payout_address = data["payout_address"] # Validate amount if not isinstance(amount_usdc, (int, float)) or amount_usdc <= 0: return jsonify({ "status": "error", "message": "amount_usdc must be a positive number" }), 400 # Validate address if not self.payment_handler._is_v ...[truncated 4737 chars]- Remediation
View remediation