T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- src/index.js:43
- Finding
- Unauthenticated Access to Sensitive User Data and Safety-Critical Operations<![CDATA[ ## Vulnerability Details **File Location**: `src/index.js:43-52, 62-84, 88-110, 114-150, 155-173` **Vulnerability Type**: Missing authentication and object-level authorization **Risk Level**: Critical ### Vulnerable Code ```javascript setupMiddleware() { this.app.use(express.json()); this.app.use((req, res, next) => { res.header('Access-Control-Allow-Origin', '*'); next(); }); this.app.use((req, res, next) => { console.log(`[${new Date().toISOString()}] ${req.method} ${req.path}`); next(); }); } ``` The following sensitive routes are registered without authentication or authorization middleware: ```javascript // Register user this.app.post('/register', async (req, res) => { try { const { userId, name, phone, emergencyContacts } = req.body; if (!userId || !name) { return res.status(400).json({ error: 'Missing required fields' }); } const user = this.userManager.registerUser(userId, { name, phone, emergencyContacts }); res.json({ success: true, message: 'Registration successful', user }); } catch (error) { console.error('Registration failed:', error); res.status(500).json({ error: error.message }); } }); // User check-in this.app.post('/checkin', async (req, res) => { try { const { userId, message, mood, location } = req.body; if (!userId) { return res.status(400).json({ error: 'Missing userId' }); } const result = this.userManager.checkin(userId, { message, mood, location }); res.json({ success: true, message: 'Check-in successful', data: result }); } catch (error) { console.error('Check-in failed:', error); res.status(500).json({ error: error.message }); } }); // Query status this.app.get('/status/:userId', (req, res) => { try { const { userId } = req.params; const status = this.userManager.getUserStatus(userId); if (!status) { ...[truncated 3870 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require authentication for every endpoint except a minimal health-check endpoint. 2. Derive the acting user identity from a verified session or token rather than trusting `userId` from request bodies. 3. Add object-level authorization checks so ordinary users can access and modify only their own records. 4. Require stronger authorization and reauthentication for emergency-contact changes. 5. Reject duplicate registration rather than overwriting existing users. 6. Use cryptographically random internal identifiers and avoid exposing predictable IDs. 7. Return data-transfer objects containing only fields required by each endpoint; do not return the complete stored user object. 8. Restrict CORS to explicitly trusted application origins and configure allowed methods and headers. 9. Add rate limiting, audit logging, request validation, and alerts for repeated identifier enumeration. 10. Add automated tests confirming that anonymous and cross-user requests receive `401 Unauthorized` or `403 Forbidden`. ]]>