T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:132
- Finding
- Controller Template Disables Authentication and Authorization for All Actions## Vulnerability Details **File Location**: `SKILL.md`, lines 132–133 **Vulnerability Type**: Wildcard authentication and authorization bypass **Risk Level**: High **Complete Code Snippet**: ```php protected $noNeedLogin = ['*']; // No login required for any method protected $noNeedRight = ['*']; // No authorization required for any method ``` ### Technical Analysis The documented frontend controller template uses wildcard exemptions for both authentication and authorization. In FastAdmin, these properties indicate which controller actions may execute without a logged-in user and without permission checks. The `'*'` value applies those exemptions to every action in the controller. Although an intentionally public, read-only index action may not require authentication, this template establishes an insecure default that also applies automatically to future actions. If a developer copies the template and later adds an endpoint that reads private information, changes application state, uploads files, or performs an administrative operation, that endpoint can remain publicly accessible unless the wildcard settings are explicitly removed. ### Attack Path 1. A developer generates or copies the controller pattern from `SKILL.md`. 2. The resulting controller inherits wildcard exemptions for login and permission checks. 3. The developer adds a sensitive action without changing the two properties. 4. An attacker identifies or predicts the route, such as `/addons/mydemo/index/<action>`. 5. The attacker invokes the action without authenticating. 6. FastAdmin skips both login validation and authorization checks because each exemption contains `'*'`. 7. The sensitive operation executes with the application privileges available to the controller. Exploitation depends on a sensitive action being added to a controller that retains this template. The supplied `index()` example alone only renders a view, so the documented pattern cre ...[truncated 739 chars]
- Remediation
- ## Remediation Suggestions - Use secure defaults by setting both exemption lists to empty: ```php protected $noNeedLogin = []; protected $noNeedRight = []; ``` - If the landing page must be public, exempt only that explicitly reviewed action: ```php protected $noNeedLogin = ['index']; protected $noNeedRight = ['index']; ``` - Keep state-changing, data-export, upload, and administrative actions behind authentication and explicit authorization checks. - Document that every newly added action requires a review of authentication, object-level authorization, and role permissions. - Require appropriate HTTP methods and CSRF protection for state-changing operations. - Add automated tests confirming that protected routes reject unauthenticated users and users lacking the required permission. - Avoid wildcard exemptions in reusable examples because copied templates commonly persist into production code.