T05 · Unauthorized Access and Privilege Escalation
Error
- Location
integration/api.js:27- Finding
Trivially Forgeable API Key Authentication
- Content
View full analysis
20; } ``` ### Technical Analysis The API accepts any value that starts with `viz_` and is longer than 20 characters. It does not verify that the key was issued by the application, exists in a trusted key store, has not been revoked, or possesses permission for the requested operation. Although `security/auth.js` contains a stronger key-generation and lookup mechanism, the REST API does not use it. Consequently, the authentication middleware provides only format validation rather than proof of identity. The API also accepts credentials through the `api_key` query parameter. Query strings are commonly retained in browser history, reverse-proxy access logs, analytics systems, and monitoring products, increasing the risk of credential disclosure if real key validation is later introduced without changing this behavior. ### Attack Path 1. An attacker creates an arbitrary value satisfying the format check, such as `viz_aaaaaaaaaaaaaaaaaaaaa`. 2. The attacker submits the value through the `x-api-key` header or `api_key` query parameter. 3. `isValidAPIKey()` returns `true` based only on the prefix and length. 4. The middleware assigns the forged value to `req.apiKey` and invokes `next()` ...[truncated 642 chars]- Remediation
View remediation