Submit #1009026: https://github.com/dotnet/ eShop .NET 8 Improper Authentication

Catalog API admin mutation endpoints have no authentication - unauthenticated item creation, update, and deletion

### Summary

The Catalog API registers CreateItem, UpdateItem (v1 and v2), and DeleteItemById endpoints with no authentication or authorization requirement. Any unauthenticated network client can create, overwrite, or delete catalog items. Unlike every other microservice in the application (Ordering, Basket, Webhooks), the Catalog API does not call `builder.AddDefaultAuthentication()` in its Extensions.cs and does not apply `.RequireAuthorization()` to its mutation routes.

### Details

In `src/Catalog.API/Apis/CatalogApi.cs` (lines 92-110), the mutation routes are registered as:

```csharp
v1.MapPut("/items", UpdateItemV1)
v2.MapPut("/items/{id:int}", UpdateItem)
api.MapPost("/items", CreateItem)
api.MapDelete("/items/{id:int}", DeleteItemById)
```

None of these route registrations call `.RequireAuthorization()`.

In `src/Catalog.API/Program.cs`, neither `app.UseAuthentication()` nor `app.UseAuthorization()` is called, and there is no global authorization middleware.

In `src/Catalog.API/Extensions/Extensions.cs`, the `AddApplicationServices` method does not call `builder.AddDefaultAuthentication()`, unlike the Basket API (`src/Basket.API/Extensions/Extensions.cs` line 10: `builder.AddDefaultAuthentication()`), the Ordering API (`src/Ordering.API/Extensions/Extensions.cs` line 10: `builder.AddDefaultAuthentication()`), and the Webhooks API.

This is confirmed in the AppHost configuration (`src/eShop.AppHost/Program.cs`): the `catalogApi` resource is the only service not passed `Identity__Url` as an environment variable. The basket, ordering, and webhooks services all receive `.WithEnvironment("Identity__Url", identityEndpoint)`, which is what triggers the JWT bearer middleware registration. Catalog receives no such configuration.

Additionally, `src/eShop.AppHost/Extensions.cs` registers a YARP catch-all route `/api/catalog/{*any}` in `ConfigureMobileBffRoutes` that forwards all catalog API requests (including mutations) from the mobile BFF without adding any authentication layer.

### PoC

(available upon request)

### Impact

Any unauthenticated attacker with network access to the Catalog API (directly or via the YARP mobile BFF) can add fraudulent products at arbitrary prices, modify existing product prices to cause financial loss, or delete all catalog items to cause a denial of service for the storefront. In a production deployment this would allow price manipulation attacks (creating $0.01 items), catalog defacement, and complete inventory destruction.

• Quelle: ⚠️ https://github.com/dotnet/eShop/issues/997
• Benutzer: geochen (UID 78995)
• Einreichung: 01.10.2026 02:20 (vor 24 Tagen)
• Moderieren: 18.10.2026 12:46 (17 days later)
• Status: Akzeptiert
• VulDB Eintrag: 421692 [dotnet eShop bis 913acea66708a59595351174cee9b29f37179d29 Catalog API Extensions.cs AddApplicationServices schwache Authentisierung]
• Punkte: 20