How Unauthenticated Endpoint Exposure Happens in Node.js and How to Fix It

How Unauthenticated Endpoint Exposure Happens in Node.js and How to Fix It

The Problem with Debug Routes That Outlive Development

The dep/src/server/index.js file bootstraps the application's HTTP server and registers its routes. Most of those routes are presumably guarded — but one was not: /--ziko--. This route, likely added during development to inspect internal state, unconditionally returned the contents of globalThis.Ziko to any HTTP client that asked. No token. No session check. No environment guard. Just a raw JSON dump of the application's global state, served to the world.

This is a textbook example of a debug endpoint that was never hardened for production. It is also one of the most common security mistakes in Node.js services, because the framework makes adding a quick diagnostic route trivially easy — and equally easy to forget.

The Vulnerability Explained

The vulnerable code, before the fix, looked like this:

// dep/src/server/index.js — BEFORE FIX
app.get('/--ziko--', (req, res) => {
  res.json(globalThis.Ziko)
})

There are two compounding problems here:

1. No authentication or authorization check.
Any HTTP client — a browser, curl, a malicious script — can GET /--ziko-- and receive a JSON response containing whatever globalThis.Ziko holds. In a Node.js application, globalThis is the top-level global object. Storing application state there and then serving it over an unauthenticated HTTP endpoint means the entire contents are readable by anyone who can reach the server's port.

2. No environment guard.
Even if the intent was "this is only for development," the code contains no check like if (process.env.NODE_ENV !== 'production'). The route is registered and active regardless of the deployment environment.

What Does globalThis.Ziko Actually Contain?

That depends on the application, but the pattern globalThis.Ziko suggests a central state or configuration object. In the worst case it could include:

• API keys or credentials loaded at startup
• Internal service URLs or topology information
• User session data or application secrets
• Configuration flags that reveal security posture

Even if the current contents seem benign, the route is a stable, predictable URL (/--ziko-- is distinctive enough to be discoverable by anyone who reads the source) that will serve whatever ends up in globalThis.Ziko as the application evolves.

Attack Scenario

An attacker who discovers this repository (it is a public or semi-public Node.js library, per the threat model context) reads dep/src/server/index.js, notes the /--ziko-- endpoint, and sends a single HTTP request to any deployed instance:

curl https://target-app.example.com/--ziko--

The server responds with a JSON object containing the application's internal state. The attacker now has a reconnaissance foothold — configuration details, internal URLs, or credentials — that can be used to escalate the attack. No credentials were required. No rate limit was hit. The entire operation takes under a second.

This maps directly to CWE-306: Missing Authentication for Critical Function and is classified as a Broken Access Control issue under OWASP Top 10 (A01:2021).

The Fix

The fix is a single line added as the very first statement inside the route handler:

// dep/src/server/index.js — AFTER FIX
app.get('/--ziko--', (req, res) => {
  if (isProduction) return res.status(404).end();
  res.json(globalThis.Ziko)
})

Before:

app.get('/--ziko--', (req, res) => {
  res.json(globalThis.Ziko)
})

After:

app.get('/--ziko--', (req, res) => {
  if (isProduction) return res.status(404).end();
  res.json(globalThis.Ziko)
})

Why This Fix Works

The isProduction variable (already defined elsewhere in createServer) evaluates whether the application is running in a production environment. When it is, the handler immediately returns HTTP 404 Not Found and ends the response — no body, no headers that reveal the route exists, no data leaked.

Returning 404 rather than 403 Forbidden is a deliberate security choice: it avoids confirming to an attacker that the route exists but is protected. From the outside, the endpoint is indistinguishable from a non-existent path.

The return before res.status(404).end() is equally important — it ensures the rest of the handler body (the res.json(globalThis.Ziko) call) is never reached. Without return, JavaScript would fall through and send both responses, resulting in a "headers already sent" error at best, or a data leak at worst.

What the Fix Does Not Do (And Why That Matters)

The fix gates the endpoint on environment, but it does not add authentication to the development path. In a shared development or staging environment, the endpoint would still be accessible without credentials to anyone who can reach the server. If the application is deployed in non-production environments accessible to untrusted users, an additional authentication layer should be applied even in development mode.

Prevention & Best Practices

1. Never Register Debug Routes Without an Environment Guard

Any route added for diagnostic or development purposes should be wrapped in an environment check at registration time, not just at handler time:

if (!isProduction) {
  app.get('/--ziko--', (req, res) => {
    res.json(globalThis.Ziko)
  })
}

Registering the route conditionally means it does not exist at all in production — no handler, no path, no surface area.

2. Apply Authentication Middleware to All Non-Public Routes

Even in development, diagnostic endpoints should require some form of authentication:

if (!isProduction) {
  app.get('/--ziko--', requireDevAuth, (req, res) => {
    res.json(globalThis.Ziko)
  })
}

3. Audit Routes Systematically

Use a script or static analysis tool to enumerate all registered routes and verify each one has appropriate middleware. In Express, you can inspect app._router.stack at startup to log all registered paths and their middleware chains.

4. Use Linting Rules for Missing Auth Middleware

Tools like ESLint with custom rules, or Semgrep, can flag route handlers that lack authentication middleware in their call chain. This makes missing auth a build-time error rather than a production incident.

5. Apply the Principle of Least Exposure

Ask: "Does this route need to exist in production at all?" If the answer is no, do not register it. If the answer is "maybe," treat it as no.

Relevant Standards

• OWASP Top 10 A01:2021 — Broken Access Control: https://owasp.org/Top10/A01_2021-Broken_Access_Control/
• CWE-306: Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html
• OWASP Authentication Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html

Key Takeaways

• The /--ziko-- route in dep/src/server/index.js served globalThis.Ziko to any caller — no credentials, no environment check, no access control of any kind.
• A single if (isProduction) return res.status(404).end() line closes the exposure — but registering the route conditionally at the app.get() call is an even stronger approach.
• Returning 404 instead of 403 is intentional — it avoids confirming the route's existence to an attacker probing the surface.
• Debug endpoints in Node.js libraries are especially dangerous because they affect every downstream consumer who installs and runs the package, not just the original developer's deployment.
• globalThis is a wide-open namespace — storing sensitive application state there and then exposing it over HTTP is a pattern to actively avoid in any production-bound code.

How Orbis AppSec Detected This

• Source: The /--ziko-- HTTP GET route handler in dep/src/server/index.js, which is registered unconditionally inside createServer().
• Sink: res.json(globalThis.Ziko) — the call that serializes and transmits internal application state to the HTTP response with no prior authentication check.
• Missing control: No authentication middleware, no authorization check, and no environment guard before the res.json() call.
• CWE: CWE-306 — Missing Authentication for Critical Function.
• Fix: Added if (isProduction) return res.status(404).end(); as the first statement in the route handler, ensuring the endpoint returns no data in production deployments.

Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.

Conclusion

The /--ziko-- endpoint is a clear example of how development conveniences become production liabilities. Adding a diagnostic route takes one line in Express. Forgetting to remove or protect it before deployment takes zero additional effort — and the result is an unauthenticated window into your application's internals, accessible to anyone who can reach your server.

The fix — a single isProduction guard — is minimal but effective. The broader lesson is architectural: debug routes should be gated at registration, not just at execution, and every route in a production Node.js application should be able to answer the question "who is allowed to call this?" before it is merged.

Security is not just about the complex vulnerabilities. Sometimes it is about the one-liner that was added on a Tuesday afternoon and shipped to production on Friday.

References

• CWE-306: Missing Authentication for Critical Function
• OWASP Top 10 A01:2021 — Broken Access Control
• OWASP Authentication Cheat Sheet
• Semgrep rules for missing authentication in Express
• fix: fix security issue in index.js