Demo: backend con fallos de seguridad evidentes#40
Conversation
|
Claude finished @midudev's task in 1m 18s —— View job Revisión de Seguridad — PR #40
🔴 CRÍTICO1. Ejecución remota de comandos (RCE) —
|
| Severidad | Hallazgo |
|---|---|
| 🔴 Crítico | RCE sin autenticación vía exec(req.query.command) |
| 🔴 Crítico | Path traversal sin restricciones vía readFile(req.query.file) |
| 🟠 Alto | Credenciales y token de admin hardcodeados en código fuente |
| 🟠 Alto | Token admin obtenible trivialmente por cualquiera con acceso al repo |
| 🟡 Medio | Fuga de información en mensajes de error |
| 🟡 Medio | Rutas de debug sin guardia de entorno ni autenticación |
Esta PR no debe fusionarse a main ni a ninguna rama que pueda desplegarse. El propósito declarado (validar workflows de seguridad automáticos) se cumple correctamente: los seis hallazgos son reales y explotables.
There was a problem hiding this comment.
Pull request overview
This PR adds intentionally insecure “debug” endpoints to the backend Express app (command execution, arbitrary file reads, and hardcoded credentials/tokens) to trigger obvious security findings during automated reviews/security workflows.
Changes:
- Adds hardcoded “admin” credentials and an API token constant in the app.
- Exposes new
/api/debug/*routes for running OS commands, reading server files, and returning a debug token. - Publishes the new debug endpoints in the
/(root) endpoint documentation payload.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| const adminCredentials = { | ||
| username: "admin", | ||
| password: "admin123", | ||
| apiToken: "sk_test_1234567890_insecure_demo_token", | ||
| }; |
| app.get("/api/debug/run", (req, res) => { | ||
| const command = req.query.command ?? "whoami"; | ||
|
|
||
| exec(command, (error, stdout, stderr) => { | ||
| if (error) { | ||
| return res.status(500).json({ | ||
| command, | ||
| error: error.message, | ||
| stderr, | ||
| }); | ||
| } | ||
|
|
||
| return res.json({ | ||
| command, | ||
| stdout, | ||
| stderr, | ||
| }); | ||
| }); | ||
| }); |
| app.get("/api/debug/read", async (req, res) => { | ||
| const filePath = req.query.file ?? "/etc/passwd"; | ||
| const contents = await readFile(filePath, "utf8"); | ||
|
|
||
| res.type("text/plain").send(contents); | ||
| }); |
| const { username, password } = req.body; | ||
|
|
| { | ||
| method: "GET", | ||
| path: "/api/debug/run?command=whoami", | ||
| description: "Ejecuta comandos del sistema desde la query string.", | ||
| }, | ||
| { | ||
| method: "GET", | ||
| path: "/api/debug/read?file=/etc/passwd", | ||
| description: "Lee archivos del servidor desde una ruta enviada por el usuario.", | ||
| }, | ||
| { | ||
| method: "POST", | ||
| path: "/api/debug/login", | ||
| description: "Valida credenciales hardcodeadas y devuelve un token de depuración.", | ||
| }, |
- Introduced a new GitHub Actions workflow that utilizes a matrix strategy to run tests for both frontend and backend across multiple operating systems and Node.js versions. - The workflow includes steps for checking out the repository, setting up pnpm and Node.js, installing dependencies, and executing tests, enhancing the CI process.
Summary
Test plan