T05 · Unauthorized Access and Privilege Escalation
Error
- Location
index.js:13- Finding
Unauthenticated Inference Service Exposed on All Network Interfaces
- Content
View full analysis
{ // Request data is passed to an expensive Python inference process. const results = await PythonShell.run('asr.py', options); const result = results[0]; res.json(result); }); app.post('/align', upload.single('audio'), async (req, res) => { const results = await PythonShell.run('asr.py', options); const result = results[0]; res.json(result); }); app.post('/webhook', async (req, res) => { const { type, payload } = req.body; // Webhook processing occurs without authentication. }); app.listen(PORT, HOST, () => { console.log(`Service address: http://${HOST}:${PORT}`); }); ``` ### Technical Analysis The default host is `0.0.0.0`, which exposes the Express service through every available network interface. The computational endpoints `/transcribe`, `/align`, and `/webhook` do not implement authentication, authorization, webhook signature verification, rate limiting, request quotas, or inference concurrency controls. A request to `/transcribe` or `/align` can launch a Python process and invoke a multi-gigabyte machine-learning model. Although uploaded files have a 50 MB limit, that limit does not adequately constrain CPU time, decoded audio duration, model memory use, process count, or repeated requests. JSON requests are also accepted up to 50 MB. This is especially dangerous because the service is advertised as CPU-compatible and requires substantial memory. Multiple c ...[truncated 1323 chars]- Remediation
View remediation