boardroom Server Handler Missing Authentication on HTTP Endpoints

Affected Versions

The Vulnerability Explained

The boardroom server implements an HTTP interface through a Handler class that inherits from Python's SimpleHTTPRequestHandler. This design choice provides convenient request handling, but the implementation failed to establish any authentication boundary between the server and its callers.

The vulnerable code processed all incoming requests through do_GET() and do_POST() without first establishing who was making the request:

def do_GET(self):
    path = self.path.split("?", 1)[0]
    if path == "/events.js":
        return self.stream()
    # ... additional endpoints

def do_POST(self):
    if self.path == "/dismiss":
        DISMISSED.set()
        self.send_response(204)

The server binds to a local port (typically 127.0.0.1:8080 or similar), which developers often assume provides sufficient protection. This assumption fails against DNS rebinding: an attacker hosts a malicious page at evil.example.com with a DNS TTL of 60 seconds. When the victim visits the page, their browser resolves the domain to the attacker's server. After the TTL expires, the same domain resolves to 127.0.0.1. JavaScript on the page can now make requests to http://evil.example.com:8080/alerts.json that the browser sends to the local boardroom server—with the Host: evil.example.com header that same-origin policy checks against.

The exposed endpoints carry significant risk:
- /alerts.json — Exposes internal alert state and potentially sensitive notification content
- /dismiss — Allows attackers to clear alerts, potentially hiding security notifications or operational issues
- /events.js — Server-sent events stream that could leak real-time operational data
- /icon/* — Resource access that may reveal deployment details through icon assets

The Fix

The remediation introduces an is_local_origin() method that validates the Host header against known-local values, then guards both request handlers:

def is_local_origin(self):
    # Defends against DNS rebinding: a remote page can make a browser
    # send a request to our loopback port, but it cannot forge the
    # Host header to a value the browser itself resolved to us.
    host = self.headers.get("Host", "").split(":", 1)[0]
    return host in ("127.0.0.1", "localhost", "::1")

Both entry points now reject non-local requests:

def do_GET(self):
    if not self.is_local_origin():
        return self.send_error(403)
    # ... existing handling

def do_POST(self):
    if not self.is_local_origin():
        return self.send_error(403)
    # ... existing handling

This defense exploits a critical asymmetry in DNS rebinding: while attackers can manipulate DNS resolution, they cannot control what Host header the browser sends. The browser resolves evil.example.com to 127.0.0.1 and connects there, but still transmits Host: evil.example.com. The server rejects this mismatch with HTTP 403.

Key Takeaways

• Localhost binding is not authentication: Services bound to 127.0.0.1 remain reachable through DNS rebinding; explicit origin validation is required for any sensitive endpoint.

• SimpleHTTPRequestHandler provides no security controls: The convenience of Python's built-in HTTP handler comes with zero authentication, authorization, or origin checking—every production use requires adding these explicitly.

• DNS rebinding bypasses same-origin policy timing: Short DNS TTLs allow attackers to pivot from their infrastructure to internal services while maintaining the appearance of a same-origin request from the browser's perspective.

• Host header validation is a necessary but narrow defense: This fix specifically targets browser-based DNS rebinding; additional controls (network namespaces, authentication tokens, request signing) may be needed depending on threat model.

How Orbis AppSec Detected This

Source: HTTP request parameters and headers entering through Handler.do_GET() and Handler.do_POST()

Sink: Sensitive operations including DISMISSED.set() (state modification), self.stream() (data exfiltration), and self.icon() (resource access)

Missing control: No validation of caller identity, authorization, or request origin before processing

CWE: CWE-287 — Improper Authentication

Fix: Added is_local_origin() method validating Host header against localhost addresses, with 403 rejection for non-local origins in both GET and POST handlers.

Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.

Conclusion

The boardroom server's missing authentication on internal HTTP endpoints exemplifies a common pattern: assuming localhost binding provides sufficient protection. The DNS rebinding threat model demonstrates why explicit origin validation matters even for services never intended to face the public internet. The is_local_origin() fix provides targeted protection against browser-based attacks, though organizations deploying similar services should evaluate whether additional authentication layers are appropriate for their operational context.