T05 · Unauthorized Access and Privilege Escalation
Error
- Location
src/index.js:42- Finding
Unauthenticated Access and Modification of Sensitive User Records
- Content
View full analysis
{ res.header('Access-Control-Allow-Origin', '*'); next(); }); this.app.use((req, res, next) => { console.log(`[${new Date().toISOString()}] ${req.method} ${req.path}`); next(); }); } ``` The following sensitive routes are installed without any intervening authentication or authorization middleware: ```js this.app.post('/register', async (req, res) => { // Registration is selected entirely through userId supplied by the caller. }); this.app.post('/checkin', async (req, res) => { // Check-ins are recorded for userId supplied by the caller. }); this.app.get('/status/:userId', (req, res) => { // The requested user is selected directly from the path parameter. }); this.app.get('/history/:userId', (req, res) => { // Check-in history is selected directly from the path parameter. }); this.app.post('/emergency-contacts', async (req, res) => { // Emergency contacts are updated using userId supplied by the caller. }); ``` The underlying status method returns the complete user object: ```js return { ...user, hoursSinceLastCheckin, status, currentTime: now.toISOString() }; ``` ### Technical Analysis The service does not establish an authenticated identity and does not verify that a caller is authorized to access the supplied `userId`. This creates insecure direct object reference and broken object-level authorization vulnerabilities. A caller who knows or guesses a user ID can retrieve status and check-in history. The status response spreads the complete user record into the response, including phone numbers and emergency-contact details. Check-in history can expose messages, mood information, timestamps, and location. ...[truncated 1663 chars]- Remediation
View remediation