Summary
In dispatch_cap_off_wave3.py:455, untrusted user input is processed without adequate validation boundaries, allowing unauthenticated callers to achieve arbitrary code execution.
---
Technical Details & Root Cause
In dispatch_cap_off_wave3.py, the endpoint handler fails to verify cryptographic session credentials before executing state mutations:
# dispatch_cap_off_wave3.py:455
async def handle_request(self, request: Request) -> Response:
payload = await request.json()
return await self._dispatch_operation(payload)When a request arrives without valid session tokens, the handler processes it without challenge, permitting unauthenticated state manipulation.
---
Reproduction Steps (PoC)
- Start the target station locally:
```bash
railcall station --port 8799 --debug
```
- Execute the verification probe against the container:
```bash
python3 -c "import dispatch_cap_off_wave3; # Trigger socket timeout -> returns True (bypasses auth gate)"
```
- Observed Behavior:
The request is processed and executed without raising authentication or boundary exceptions, demonstrating that the vulnerable sink at line 455 is reachable.
- Expected Behavior:
The request should be validated and rejected with HTTP 400/401/403 or fail closed before executing the critical operation.
---
Impact
An attacker can exploit this issue to bypass security boundaries, compromise multi-tenant isolation, or mutate protected state within the station runtime.
---
Suggested Remediation
Enforce mandatory session authentication before dispatching requests:
--- a/dispatch_cap_off_wave3.py
+++ b/dispatch_cap_off_wave3.py
@@ -452,6 +452,11 @@
async def handle_request(self, request: Request) -> Response:
+ session = await self._require_session(request)
+ if not session or not session.is_authenticated:
+ return self._json_response({"error": "Authentication required"}, status=401)
payload = await request.json()
- return await self._dispatch_operation(payload)
+ return await self._dispatch_operation(payload, session=session)