T05 · Unauthorized Access and Privilege Escalation
Error
- Location
index.js:109- Finding
Unauthenticated Network-Accessible Control API
- Content
View full analysis
{ res.setHeader('Access-Control-Allow-Origin', '*'); res.setHeader('Content-Type', 'application/json'); const sendError = (msg) => { res.end(JSON.stringify({ error: msg })); }; const sendSuccess = (data) => { res.end(JSON.stringify(data)); }; ``` Sensitive message history is returned without authenticating the caller: ```javascript else if (req.url.startsWith('/api/messages') && req.method === 'GET') { const urlObj = require('url').parse(req.url, true); const peerId = urlObj.query.peer; const messages = this.db.all(` SELECT * FROM messages WHERE (from_agent = ? AND to_agent = ?) OR (from_agent = ? AND to_agent = ?) ORDER BY created_at ASC `, [this.nodeId, peerId, peerId, this.nodeId]); sendSuccess(messages); } ``` The same unauthenticated server permits outbound messaging and other state-changing operations: ```javascript else if (req.url === '/api/send' && req.method === 'POST') { let body = ''; req.on('data', chunk => body += chunk); req.on('end', async () => { const { to, message } = JSON.parse(body); await this.core.sendMessage(to, message); sendSuccess({ success: true }); }); } ``` The server is started without specifying a loopback address: ```javascript this.httpServer.listen(this.config.port + 1, () => { console.log(`HTTP API server listening on port ${this.config.port + 1}`); }); ``` ### Technical Analysis The HTTP API has no authentication, session validation, API token, authorization checks, or caller identity controls. It exp ...[truncated 2071 chars]- Remediation
View remediation