# Unauthenticated privileged local endpoint exposure

Local or dev-server endpoints that execute tasks, load plugins, or write agent memory without auth or Host/Origin checks

_Area: Web business logic and race conditions. Seen in 3 disclosed reports; latest 2026-09-09. Updated 2026-10-24._

## How it works
A service exposes an endpoint that performs a privileged action (spawn a task, load a plugin, write data an agent later acts on) but relies on an implicit boundary instead of an auth check. The broken assumption is that "it only listens on localhost" or "it's a dev tool" makes it safe. That boundary does not exist: a loopback bind is reachable by any page the user's browser loads, and a `0.0.0.0` bind is reachable by the whole network. With no auth, CSRF, Host or Origin validation, the privileged action runs on behalf of whoever can reach the port.

## Where it shows up
- Auth middleware applied conditionally (e.g. only in one listener mode) rather than on every route [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-xqhv-chqm-fhcc.md).
- `Access-Control-Allow-Origin: *` justified by a loopback bind [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-xqhv-chqm-fhcc.md).
- A declared `hostname` constant never passed to `listen()`, so Node binds `0.0.0.0` [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-2r5q-h53f-9rp3.md).
- Fixed, hardcoded ports with no `SERVER_NAME`/Host validation [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-37h2-6p4f-mp3q.md).
- Handlers passing request params straight into `spawn()`/`subprocess` with no allowlist [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-37h2-6p4f-mp3q.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-2r5q-h53f-9rp3.md).
- Write endpoints feeding data the agent later executes autonomously [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-37h2-6p4f-mp3q.md).

## How to review
For every route that mutates state or executes something, confirm an auth check runs on that route in every mode, not just one. Confirm the bind address matches intent: trace the hostname argument into `listen()` and check it is actually used [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-2r5q-h53f-9rp3.md). Treat loopback as untrusted: require Host/Origin validation and CSRF protection, and reject wildcard CORS on any privileged endpoint [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-37h2-6p4f-mp3q.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-xqhv-chqm-fhcc.md). The invariant: no request can trigger a privileged action unless it carries proof of authorization that a cross-origin page cannot forge. Also check that request-controlled values reaching a shell or spawn are constrained by an allowlist.

## Variants seen
- DNS rebinding against a fixed-port dashboard with no Host validation, poisoning agent memory that is later executed [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-37h2-6p4f-mp3q.md).
- Wildcard CORS plus a CORS-safelisted content type (multipart/form-data) letting cross-origin JS upload a plugin that runs on load [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-xqhv-chqm-fhcc.md).
- Dev server bound to `0.0.0.0` exposing an unauthenticated task-run endpoint to the LAN [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-2r5q-h53f-9rp3.md).

## Impact and severity
All three reached remote code execution as the operator or developer [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-37h2-6p4f-mp3q.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-xqhv-chqm-fhcc.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-2r5q-h53f-9rp3.md). Severity is high: no credentials needed, and the privileged action is code execution or memory poisoning that the agent acts on. It worsens when the endpoint is network-exposed rather than loopback-only [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-2r5q-h53f-9rp3.md), when the content type bypasses preflight [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-xqhv-chqm-fhcc.md), and when attacker-influenced data is later executed autonomously rather than immediately [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-37h2-6p4f-mp3q.md).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-37h2-6p4f-mp3q.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-xqhv-chqm-fhcc.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-2r5q-h53f-9rp3.md