acikyazilimagi / acikyazilimagi/musahit-harita-backend

Bug: Accessible Swagger Path without Required API Key

Open
#37 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
21
Forks
2
PR merge metrics
No merged PRs in 30d

Description

Description:

The current implementation of the API authorization logic checks for the presence of the exact word "swagger" in the request path to determine if an API key is required. However, this check can be easily bypassed by altering the capitalization of the word. For example, accessing "/Swagger/index.html" instead of "/swagger/index.html" allows unauthorized access without providing the required API key.

Example:

- Accessing https://backend.gonullu.io/swagger/index.html requires an API key for authorization.
![image](https://github.com/acikkaynak/musahit-harita-backend/assets/124896653/8249662e-10d5-4bb6-af1f-df048fc156a2)
- Accessing https://backend.gonullu.io/Swagger/index.html (with altered capitalization) grants access without requiring an API key.
![image](https://github.com/acikkaynak/musahit-harita-backend/assets/124896653/ea7131f6-c4b2-45ed-b4c4-435cd2a5ba6e)
![image](https://github.com/acikkaynak/musahit-harita-backend/assets/124896653/60440cfc-e0d4-402e-8724-7b45e96cb17e)
![image](https://github.com/acikkaynak/musahit-harita-backend/assets/124896653/c22107fa-19cb-43a9-89b9-a391b004bab9)

Steps to reproduce:

1. Attempt to access "https://backend.gonullu.io/swagger/index.html" without providing an API key.
2. You will notice that access is denied, indicating that the API key is required.
3. Access "https://backend.gonullu.io/Swagger/index.html" (note the altered capitalization).
4. Observe that access is granted without requiring an API key.

Impact:

Although the current vulnerability may not pose a significant security risk right now, it has the potential to cause future issues if an important file or resource is exposed within the "/swagger/" directory. This could allow unauthorized individuals to access sensitive information or exploit the exposed resources for malicious purposes.

Vulnerable code part:
```
if strings.Contains(ctx.Path(), "pprof") || strings.Contains(ctx.Path(), "swagger") || restrictedMethod {
apiKeyNeeded = true
}
```
Link: https://github.com/acikkaynak/musahit-harita-backend/blob/3e109cfb09da43b858c62f91fb282ef89fcdcc94/middleware/auth/auth.go
Line: 25

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.