T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- index.js:109
- Finding
- Unauthenticated Network-Accessible Control API<![CDATA[ ## Vulnerability Details **File Location**: `index.js:109-116`, `index.js:135-164`, `index.js:205-226`, `index.js:244-322`, `index.js:333-355`, `index.js:378-380` **Vulnerability Type**: Missing authentication and authorization, unrestricted CORS, and unrestricted network binding **Risk Level**: Critical ### Vulnerable Code ```javascript startHttpServer() { this.httpServer = http.createServer(async (req, res) => { res.setHeader('Access-Control-Allow-Origin', '*'); res.setHeader('Content-Type', 'application/json'); const sendError = (msg) => { res.end(JSON.stringify({ error: msg })); }; const sendSuccess = (data) => { res.end(JSON.stringify(data)); }; ``` Sensitive message history is returned without authenticating the caller: ```javascript else if (req.url.startsWith('/api/messages') && req.method === 'GET') { const urlObj = require('url').parse(req.url, true); const peerId = urlObj.query.peer; const messages = this.db.all(` SELECT * FROM messages WHERE (from_agent = ? AND to_agent = ?) OR (from_agent = ? AND to_agent = ?) ORDER BY created_at ASC `, [this.nodeId, peerId, peerId, this.nodeId]); sendSuccess(messages); } ``` The same unauthenticated server permits outbound messaging and other state-changing operations: ```javascript else if (req.url === '/api/send' && req.method === 'POST') { let body = ''; req.on('data', chunk => body += chunk); req.on('end', async () => { const { to, message } = JSON.parse(body); await this.core.sendMessage(to, message); sendSuccess({ success: true }); }); } ``` The server is started without specifying a loopback address: ```javascript this.httpServer.listen(this.config.port + 1, () => { console.log(`HTTP API server listening on port ${this.config.port + 1}`); }); ``` ### Technical Analysis The HTTP API has no authentication, session validation, API token, authorization checks, or caller identity controls. It exp ...[truncated 2071 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Bind the API explicitly to a loopback address: ```javascript this.httpServer.listen(this.config.port + 1, '127.0.0.1', callback); ``` 2. Require a cryptographically random authentication token on every endpoint. 3. Separate read-only status operations from privileged mutation operations and enforce endpoint-specific authorization. 4. Replace wildcard CORS with an exact allowlist. For an Electron-only API, consider disabling browser CORS access entirely. 5. Add CSRF protection if browser-originated requests remain supported. 6. Enforce `Content-Type`, HTTP method, JSON schema, and maximum body length before processing requests. 7. Add rate limiting, request timeouts, and audit logging. 8. Avoid returning full local paths or private message records unless explicitly requested by an authenticated user. 9. Prefer Electron IPC with narrowly scoped handlers instead of a broadly accessible local HTTP control plane. ]]>