T05 · Unauthorized Access and Privilege Escalation
Error
- Location
src/app/api/portfolio/route.ts:17- Finding
Unauthenticated Portfolio Disclosure and Modification API
- Content
View full analysis
sum + s.totalRealizedPL, 0); return NextResponse.json({ portfolio, portfolios: state.portfolios, activePortfolioId: state.activePortfolioId, realizedPL, sellHistory, }); } export async function POST(request: Request) { try { const body = await request.json(); if (body.action === 'createPortfolio') { const portfolio = createPortfolio(body.name); return NextResponse.json(portfolio, { status: 201 }); } if (body.action === 'setActive') { const portfolio = setActivePortfolio(body.id); if (!portfolio) { return NextResponse.json({ error: 'Portfolio not found' }, { status: 404 }); } return NextResponse.json(portfolio); } if (body.action === 'deletePortfolio') { const success = deletePortfolio(body.id); if (!success) { return NextResponse.json({ error: 'Cannot delete last portfolio' }, { status: 400 }); } return NextResponse.json({ success: true }); } // The remainder of this handler also processes sales and adds holdings // without authenticating or authorizing the caller. ``` ```ts export async function PUT(request: Request) { try { const { id, updates } = await request.json(); const holding = updateHolding(id, updates); if (!holding) { return NextResponse.json({ error: 'Holding not found' }, { status: 404 }); } return NextResponse.json(holding); } catch (error) { return NextResponse.json({ error: 'Failed to update holding' }, { status: 500 }); } } export async function DEL ...[truncated 3081 chars]- Remediation
View remediation
` updates with an allowlist of fields that users are permitted to modify. Never allow an update request to replace the holding ID. 7. Validate symbols, asset types, names, ISO dates, quantities, and prices. Require finite positive numeric values where appropriate and enforce reasonable string and collection limits. 8. Separate POST actions into dedicated endpoints or use a strict discriminated union so that missing or unknown actions cannot fall through to holding creation. 9. Add authorization-focused integration tests covering anonymous GET, POST, PUT, DELETE, and export requests. 10. Maintain backups or an append-only audit log for destructive portfolio operations. ]]>