T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:175- Finding
Fail-Open Feature Authorization Allows Premium Access Bypass
- Content
View full analysis
= requiredTier, nil } ``` ### Technical Analysis The authorization function grants access whenever a feature identifier is absent from the hard-coded requirements map. This is a fail-open authorization design. A protected feature can therefore become publicly accessible if: - A developer adds a new feature but forgets to add it to the map. - A handler and the authorization map use different spellings. - The feature identifier is derived from attacker-controlled request data. - A refactor changes the identifier without updating the map. Authorization systems should deny unknown resources by default. The current behavior instead treats an unrecognized identifier as evidence that no authorization is required. ### Attack Path 1. The attacker identifies a premium operation whose feature identifier is missing from the requirements map, or supplies an unrecognized identifier if the request controls it. 2. The middleware passes that identifier to `CheckFeatureAccess`. 3. The map lookup returns `exists == false`. 4. The function returns `true, nil` without checking a required subscription tier. 5. The protected handler executes for an unauthorized use ...[truncated 479 chars]- Remediation
View remediation
= requiredTier, nil ``` ]]>