T09 · Insecure Skill Coding Practices
Warning
- Location
src/process-guard.js:382- Finding
Unauthenticated Dashboard Binds to All Network Interfaces
- Content
View full analysis
{ if (req.url === '/health') { res.writeHead(200, { 'Content-Type': 'text/plain' }); return res.end('OK'); } if (req.url === '/status' || req.url === '/') { res.writeHead(200, { 'Content-Type': 'application/json' }); return res.end(JSON.stringify(this.status(), null, 2)); } res.writeHead(404); res.end('Not found'); }); this._httpServer.listen(port, () => { this._log(`Dashboard: http://localhost:${port}/status`); }); } ``` ### Technical Analysis The server calls `listen(port)` without specifying a host address. In Node.js, this commonly listens on the unspecified address and may accept connections through every available network interface. This conflicts with the log message and documentation, which represent the dashboard as a localhost endpoint. Neither `/status` nor `/health` implements authentication, authorization, or client-origin restrictions. Consequently, enabling `dashboardPort` on a network-accessible host can expose the service to unauthenticated remote clients. The `/status` response includes monitored process names, health stages, uptime percentages, restart counts, last-up timestamps, CPU and memory usage, alert counts, and recent restart history. ### Attack Path 1. An operator enables `dashboardPort`, expecting the endpoint to be local because it is documented and logged as `localhost`. 2. ProcessGuard invokes `listen(port)` without a loopback bind address. 3. The operating system exposes the port through one or more external interfaces, subject to firewall configuration. 4. An attacker with network access scans for or otherwise discovers the configured port. 5. The attacker se ...[truncated 790 chars]- Remediation
View remediation
{ this._log(`Dashboard: http://${host}:${port}/status`); }); ``` 2. Add an explicit `dashboardHost` configuration option. Require deliberate configuration before allowing a wildcard or non-loopback address. 3. Require authentication for remotely exposed dashboards, such as a securely generated bearer token validated with timing-safe comparison. 4. When a non-loopback address is selected, emit a prominent warning that the endpoint exposes operational information. 5. Recommend firewall restrictions or an authenticated TLS reverse proxy for remote access. 6. Minimize the information returned by `/status`, especially where process names or operational history are not required. ]]>