| शीर्षक | https://github.com/dotnet/ eShop .NET 8 Improper Authentication |
|---|
| विवरण | Catalog API admin mutation endpoints have no authentication - unauthenticated item creation, update, and deletion
### Summary
The Catalog API registers CreateItem, UpdateItem (v1 and v2), and DeleteItemById endpoints with no authentication or authorization requirement. Any unauthenticated network client can create, overwrite, or delete catalog items. Unlike every other microservice in the application (Ordering, Basket, Webhooks), the Catalog API does not call `builder.AddDefaultAuthentication()` in its Extensions.cs and does not apply `.RequireAuthorization()` to its mutation routes.
### Details
In `src/Catalog.API/Apis/CatalogApi.cs` (lines 92-110), the mutation routes are registered as:
```csharp
v1.MapPut("/items", UpdateItemV1)
v2.MapPut("/items/{id:int}", UpdateItem)
api.MapPost("/items", CreateItem)
api.MapDelete("/items/{id:int}", DeleteItemById)
```
None of these route registrations call `.RequireAuthorization()`.
In `src/Catalog.API/Program.cs`, neither `app.UseAuthentication()` nor `app.UseAuthorization()` is called, and there is no global authorization middleware.
In `src/Catalog.API/Extensions/Extensions.cs`, the `AddApplicationServices` method does not call `builder.AddDefaultAuthentication()`, unlike the Basket API (`src/Basket.API/Extensions/Extensions.cs` line 10: `builder.AddDefaultAuthentication()`), the Ordering API (`src/Ordering.API/Extensions/Extensions.cs` line 10: `builder.AddDefaultAuthentication()`), and the Webhooks API.
This is confirmed in the AppHost configuration (`src/eShop.AppHost/Program.cs`): the `catalogApi` resource is the only service not passed `Identity__Url` as an environment variable. The basket, ordering, and webhooks services all receive `.WithEnvironment("Identity__Url", identityEndpoint)`, which is what triggers the JWT bearer middleware registration. Catalog receives no such configuration.
Additionally, `src/eShop.AppHost/Extensions.cs` registers a YARP catch-all route `/api/catalog/{*any}` in `ConfigureMobileBffRoutes` that forwards all catalog API requests (including mutations) from the mobile BFF without adding any authentication layer.
### PoC
(available upon request)
### Impact
Any unauthenticated attacker with network access to the Catalog API (directly or via the YARP mobile BFF) can add fraudulent products at arbitrary prices, modify existing product prices to cause financial loss, or delete all catalog items to cause a denial of service for the storefront. In a production deployment this would allow price manipulation attacks (creating $0.01 items), catalog defacement, and complete inventory destruction.
|
|---|
| स्रोत | ⚠️ https://github.com/dotnet/eShop/issues/997 |
|---|
| उपयोगकर्ता | geochen (UID 78995) |
|---|
| सबमिशन | 01/10/2026 02:20 AM (19 दिन पहले) |
|---|
| संयम | 18/10/2026 12:46 PM (17 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 421692 [dotnet eShop तक 913acea66708a59595351174cee9b29f37179d29 Catalog API Extensions.cs AddApplicationServices कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|