Authentication Bypass Fix & PoC for Rust HTTP Service

Vulnerability Key Information Summary Vulnerability Overview Type: Missing Authentication (Authentication Bypass) Description: The and endpoints previously did not require authentication, allowing any unauthenticated remote caller to attempt brute-forcing the vault password or replaying a valid recovery key. Risk: Password hashes ( ), sessions, private keys, and API keys are stored in unencrypted form, visible only to those holding SSH keys, channel keys, webhook keys, and provider keys. Before login, the vault is in a "locked" state, but the unlock/recover endpoints lack an authentication check, creating an authentication gap. Scope of Impact Affected Endpoints: - - Impact: Unauthenticated users can initiate unlock/recover requests, creating a risk of the vault password being brute-forced or the recovery key being replayed. Related: The sibling endpoints , , and already carry an , while only unlock and recover were missing it. Fix Core Change: In , an extractor was added to and to enforce authentication before request body processing. Specific Changes: - Added the extractor to and in , enforcing authentication before request body processing. - Added 4 new integration tests in . - Updated documentation in and , marking unlock/recover/initialize/enable as . - Restored session Cookie in examples. POC / Exploitation Code Verification Results : 13 passed, 0 failed Regression tests: Both regression tests returned 200 instead of 401 (before the fix) Manual QA: Unlock requests returned 401 when no session Cookie was present (after the fix) Follow-up Items (Not Included in This PR) Endpoints were not passing through ; authenticated sessions could still be brute-forced for the vault password, requiring separate handling.

Goal Reached Thanks to every supporter — we hit 100%!

Authentication Bypass Fix & PoC for Rust HTTP Service

More from this source