T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- src/index.js:42
- Finding
- Unauthenticated Access and Modification of Sensitive User Records<![CDATA[ ## Vulnerability Details **File Location**: `src/index.js:42-169` **Vulnerability Type**: Missing authentication and object-level authorization with unrestricted CORS **Risk Level**: Critical ### Evidence ```js setupMiddleware() { this.app.use(express.json()); this.app.use((req, res, next) => { res.header('Access-Control-Allow-Origin', '*'); next(); }); this.app.use((req, res, next) => { console.log(`[${new Date().toISOString()}] ${req.method} ${req.path}`); next(); }); } ``` The following sensitive routes are installed without any intervening authentication or authorization middleware: ```js this.app.post('/register', async (req, res) => { // Registration is selected entirely through userId supplied by the caller. }); this.app.post('/checkin', async (req, res) => { // Check-ins are recorded for userId supplied by the caller. }); this.app.get('/status/:userId', (req, res) => { // The requested user is selected directly from the path parameter. }); this.app.get('/history/:userId', (req, res) => { // Check-in history is selected directly from the path parameter. }); this.app.post('/emergency-contacts', async (req, res) => { // Emergency contacts are updated using userId supplied by the caller. }); ``` The underlying status method returns the complete user object: ```js return { ...user, hoursSinceLastCheckin, status, currentTime: now.toISOString() }; ``` ### Technical Analysis The service does not establish an authenticated identity and does not verify that a caller is authorized to access the supplied `userId`. This creates insecure direct object reference and broken object-level authorization vulnerabilities. A caller who knows or guesses a user ID can retrieve status and check-in history. The status response spreads the complete user record into the response, including phone numbers and emergency-contact details. Check-in history can expose messages, mood information, timestamps, and location. ...[truncated 1663 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require authentication on every endpoint except a minimal health check. 2. Derive the target user identity from a validated session or signed token rather than trusting a caller-supplied `userId`. 3. Enforce object-level authorization before every read or mutation. 4. Separate user and administrator capabilities through explicit roles and least-privilege policies. 5. Prevent registration from silently overwriting an existing user. 6. Require additional verification for emergency-contact changes and notify the account owner when contacts are modified. 7. Return data-transfer objects containing only fields required by each endpoint; never spread the complete stored user object into a response. 8. Restrict CORS to explicitly trusted HTTPS origins and define permitted methods and headers. 9. Add schema validation, rate limiting, audit logging, and user-ID enumeration protections. 10. Add tests proving that one identity cannot read, check in for, register over, or modify contacts for another identity. ]]>