acikyazilimagi / acikyazilimagi/musahit-harita-backend

Bug: Accessible Swagger Path without Required API Key

Offen
#37 1 Kommentar 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
Go
Sterne
21
Forks
2
PR-Merge-Kennzahlen
Keine gemergten PRs in 30 T.

Beschreibung

Description:

The current implementation of the API authorization logic checks for the presence of the exact word "swagger" in the request path to determine if an API key is required. However, this check can be easily bypassed by altering the capitalization of the word. For example, accessing "/Swagger/index.html" instead of "/swagger/index.html" allows unauthorized access without providing the required API key.

Example:

- Accessing https://backend.gonullu.io/swagger/index.html requires an API key for authorization.
![image](https://github.com/acikkaynak/musahit-harita-backend/assets/124896653/8249662e-10d5-4bb6-af1f-df048fc156a2)
- Accessing https://backend.gonullu.io/Swagger/index.html (with altered capitalization) grants access without requiring an API key.
![image](https://github.com/acikkaynak/musahit-harita-backend/assets/124896653/ea7131f6-c4b2-45ed-b4c4-435cd2a5ba6e)
![image](https://github.com/acikkaynak/musahit-harita-backend/assets/124896653/60440cfc-e0d4-402e-8724-7b45e96cb17e)
![image](https://github.com/acikkaynak/musahit-harita-backend/assets/124896653/c22107fa-19cb-43a9-89b9-a391b004bab9)

Steps to reproduce:

1. Attempt to access "https://backend.gonullu.io/swagger/index.html" without providing an API key.
2. You will notice that access is denied, indicating that the API key is required.
3. Access "https://backend.gonullu.io/Swagger/index.html" (note the altered capitalization).
4. Observe that access is granted without requiring an API key.

Impact:

Although the current vulnerability may not pose a significant security risk right now, it has the potential to cause future issues if an important file or resource is exposed within the "/swagger/" directory. This could allow unauthorized individuals to access sensitive information or exploit the exposed resources for malicious purposes.

Vulnerable code part:
```
if strings.Contains(ctx.Path(), "pprof") || strings.Contains(ctx.Path(), "swagger") || restrictedMethod {
apiKeyNeeded = true
}
```
Link: https://github.com/acikkaynak/musahit-harita-backend/blob/3e109cfb09da43b858c62f91fb282ef89fcdcc94/middleware/auth/auth.go
Line: 25

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.