T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- index.js:104
- Finding
- Unauthenticated Network-Accessible HTTP API Exposes and Mutates Agent Data<![CDATA[ ## Vulnerability Details **File Location**: `index.js:104-112, 121-159, 188-320, 377-379` **Vulnerability Type**: Missing authentication and authorization; permissive CORS; insecure network binding **Risk Level**: High ### Vulnerable Code ```javascript this.httpServer = http.createServer(async (req, res) => { res.setHeader('Access-Control-Allow-Origin', '*'); res.setHeader('Content-Type', 'application/json'); const sendError = (msg) => { res.end(JSON.stringify({ error: msg })); }; const sendSuccess = (data) => { res.end(JSON.stringify(data)); }; ``` Representative sensitive read operation: ```javascript else if (req.url.startsWith('/api/messages') && req.method === 'GET') { const urlObj = require('url').parse(req.url, true); const peerId = urlObj.query.peer; const messages = this.db.all(` SELECT * FROM messages WHERE (from_agent = ? AND to_agent = ?) OR (from_agent = ? AND to_agent = ?) ORDER BY created_at ASC `, [this.nodeId, peerId, peerId, this.nodeId]); sendSuccess(messages); } ``` Representative state-changing operations: ```javascript else if (req.url === '/api/send' && req.method === 'POST') { let body = ''; req.on('data', chunk => body += chunk); req.on('end', async () => { const { to, message } = JSON.parse(body); await this.core.sendMessage(to, message); sendSuccess({ success: true }); }); } else if (req.url === '/api/publish' && req.method === 'POST') { let body = ''; req.on('data', chunk => body += chunk); req.on('end', async () => { const { skillPath, price, metadata } = JSON.parse(body); const skillId = await this.skills.publish(skillPath, price, metadata); await this.core.shareSkill( skillId, metadata.name || skillPath, metadata.description, price ); sendSuccess({ success: true, skillId }); }); } ``` The server is started without restricting it to the loopback interface: ```javascript this.httpServer.listen(thi ...[truncated 2622 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Bind the management API explicitly to loopback unless remote administration is required: ```javascript this.httpServer.listen(this.config.port + 1, '127.0.0.1', callback); ``` - Require a cryptographically random authentication token for every route. Store it with restrictive file permissions and compare it using a timing-safe operation. - Prefer authenticated Electron IPC over an HTTP management API for desktop-only operations. - Implement route-level authorization, particularly for messaging, skill publication, sharing, rating, and point-changing operations. - Replace wildcard CORS with a strict origin allowlist. Reject requests with missing or unexpected `Origin` headers where appropriate. - Implement CSRF protection if browser-originated state-changing requests remain supported. - Set explicit body-size limits and return HTTP `413` when exceeded. - Add rate limits and audit logging for sensitive operations. - Return appropriate status codes and avoid exposing internal exception messages. - Require explicit user confirmation for outbound messages, publication, downloads, and sharing of memory-like content. ]]>