T05 · Unauthorized Access and Privilege Escalation
Error
- Location
assets/gateway-monitor/server.js:1642- Finding
Unauthenticated sensitive monitoring APIs are exposed on all network interfaces
- Content
View full analysis
{ const parsed = url.parse(req.url, true); const pathname = parsed.pathname; if (pathname === '/api/gateway-status') { const gateway = gatewayStatus(); return json(res, { now: new Date().toISOString(), gateway, model: currentModel(), context: sessionContextStatus(), metrics: buildMetrics(gateway) }); } if (pathname === '/api/sessions') { const ctx = sessionContextStatus(); return json(res, { now: new Date().toISOString(), ok: ctx.ok, primary: ctx.ok ? { percentUsed: ctx.percentUsed, totalTokens: ctx.totalTokens, contextTokens: ctx.contextTokens, remainingTokens: ctx.remainingTokens, model: ctx.model, abortedLastRun: ctx.abortedLastRun } : null, sessions: ctx.sessions || [], error: ctx.error || null }); } if (pathname === '/api/bootstrap') { return json(res, buildBootstrapSnapshot()); } if (pathname === '/api/logs') { const hasLevelParam = Object.prototype.hasOwnProperty.call(parsed.query || {}, 'level'); const levelFilter = hasLevelParam ? String(parsed.query.level || '') : 'error,warn'; const entries = filterEntries(loadEntries(ONE_HOUR_MS), { signature: parsed.query.signature, level: levelFilter, keyword: parsed.query.keyword }); return json(res, { now: new Date().toISOString(), count: entries.length, items: entries.slice(0, 150) }); } if (pathname === '/api/diagnostics') { return json(res, buildDiagnosticsSnapshot()); } }); ``` ```js server.listen(PORT, '0.0.0.0', () => { console.log(`Gateway monitor running: http://127.0.0.1:${PORT}`); ...[truncated 2199 chars]- Remediation
View remediation