F-2025-0001·open-proxy

Raw request chain to external service (open proxy to Skip API)

Fixedtypescriptwidgetrouter-api
TL;DR

The Router API defined open proxy endpoints (/api/rest/*, /api/rpc/*) that forwarded the entire raw HTTP request to the Skip API with no input validation, path filtering, header/method restrictions, body sanitation, or authentication.

Severity
MEDIUM
Impact
MEDIUM
Likelihood
MEDIUM
Method
MManual review
CAT.
Complexity
LOW
Exploitability
HIGH
02Section · Description

Description

The Router API defined two proxy-style endpoints (/api/rest/* and /api/rpc/*) that forwarded the entire raw HTTP Request object, unfiltered, through the application layers and finally into an outbound axios.request(...) call targeting the Skip API (SKIP_GO_API_URL).

No input validation, path filtering, header or method restrictions, body sanitation, or authentication were applied. The result was a generic unauthenticated passthrough interface to an external API, over which clients could execute arbitrary calls with custom payloads.

03Section · Recommendation

Recommendation

Restrict the proxy to a closed allowlist of paths, methods, and headers. Validate the body against expected schemas. Authenticate the caller before forwarding.

Initia: Resolved. Pashov Audit Group: Resolved. See the report for full detail.

Status
Fixed
Fix commit
de9d3602dc1a
Fix date
2025-06-23
F-2025-0001