T05 · Unauthorized Access and Privilege Escalation
Error
- Location
server.js:79- Finding
Unauthenticated Render Endpoint Exposes Internal Image Generation and Persistent File Creation
- Content
View full analysis
{ console.log('[INFO] Received render request'); console.log('[INFO] Title:', req.body.title, '| Article count:', req.body.articles?.length || 0); const errors = validateInput(req.body); if (errors.length > 0) { return res.status(400).json({ success: false, errors: errors }); } try { const id = generateId(); // The request can initiate image generation against an internal service. const comfyOptions = req.body.comfyOptions || {}; const imagePromptIndex = findImagePromptArticle(req.body.articles); if (comfyOptions.enabled !== false && imagePromptIndex >= 0) { const article = req.body.articles[imagePromptIndex]; const comfyAvailable = await checkAvailability(); if (comfyAvailable) { const generateOptions = { timeout: comfyOptions.timeout || 120000, interval: comfyOptions.interval || 2000, width: comfyOptions.width || 1024, height: comfyOptions.height || 1024 }; const result = await generateImage(article.imagePrompt, generateOptions); req.body.articles[imagePromptIndex].imageUrl = result.imageUrl; } } const html = template(templateData); const outputPath = path.join(outputDir, `${id}.html`); fs.writeFileSync(outputPath, html, 'utf-8'); res.json({ success: true, id: id, url: `http://localhost:${PORT}/output/${id}.html` }); } catch (error) { res.status(500).json({ success: false, ...[truncated 2131 chars]- Remediation
View remediation
{ console.log(`Service available at http://127.0.0.1:${PORT}`); }); ``` 2. If remote access is required, enforce authentication and authorization on `/render`. 3. Place the service behind a reverse proxy with TLS, request-size limits, authentication, and per-client rate limits. 4. Introduce per-user generation quotas and global concurrency limits. 5. Apply restrictive network policy so only this service can reach the intended ComfyUI instance. 6. Implement expiration and periodic deletion of generated output files. 7. Return externally configured URLs rather than assuming `localhost`. 8. Monitor repeated render requests, failed authentication, generation duration, and output-directory growth. ]]>