T05 · Unauthorized Access and Privilege Escalation
Error
- Location
shield.py:315- Finding
Whitelist Peer Review Can Be Bypassed Using Unauthenticated Approver Names
- Content
View full analysis
Dict: """Approve einen Whitelist-Eintrag (Peer Review).""" import yaml wl = load_whitelist() settings = wl.get("settings", _WL_DEFAULTS["settings"]) for entry in wl.get("entries", []): if entry.get("seq") == seq: # Self-Approve pruefen (case-insensitive, GUARDIAN Pentest Finding 1) if not settings.get("self_approve", False): if entry.get("proposed_by", "").upper() == approved_by.upper(): return {"error": f"Self-Approve verboten! {approved_by} hat diesen Eintrag vorgeschlagen."} # Doppelt-Approve pruefen (case-insensitive) if approved_by.upper() in [a.upper() for a in entry.get("approved_by", [])]: return {"error": f"{approved_by} hat bereits approved!"} entry["approved_by"].append(approved_by) # Chain muss neu berechnet werden (approved_by hat sich geaendert) # Alle nachfolgenden Entry-Hashes aktualisieren _recompute_chain_from(wl, seq) _save_whitelist(wl) _audit_log(entry.get("text_hash", "")[:16], f"APPROVE seq={seq} by={approved_by} total={len(entry['approved_by'])}") ``` The approver identity comes directly from the user-controlled `--by` argument declared at `shield.py:794`: ```python parser.add_argument("--by", help="Container-Name (fuer propose/approve)") ``` ### Technical Analysis The peer-review mechanism treats an arbitrary string supplied through `--by` as an authenticated identity. It prevents only identical names, case-insensitive duplicate names, and a name matching the proposer. It does not verify that the named peer exists, authenticate the caller, c ...[truncated 1867 chars]- Remediation
View remediation