| Titolo | letta-ai LettaBot 0.2.0 Missing Authentication for Critical Function (CWE-306) |
|---|
| Descrizione | # Technical Details
An Unauthenticated Portal Management Endpoint Access exists in the `GET /api/v1/pairing/:channel` and `GET /api/v1/status` routes in `src/api/server.ts` of LettaBot.
The application fails to enforce API key authentication on portal-backed read endpoints when the agent conversation mode is `shared` (the default). Both routes conditionally skip API key validation when `getPortalMode(options)` resolves to `shared`: `if (getPortalMode(options) !== 'shared' && !validateApiKey(req.headers, options.apiKey))`. In default shared mode, the authorization branch is skipped entirely, allowing unauthenticated remote callers to query pairing request listings and agent status metadata.
# Vulnerable Code
File: src/api/server.ts
Method: GET /api/v1/pairing/:channel handler (line ~449-456) and GET /api/v1/status handler (line ~707-714); getPortalMode() (line ~928-934)
Why: The mode-gated authorization check only rejects unauthenticated requests when mode is NOT shared. In the default shared mode, the guard evaluates `getPortalMode(options) !== 'shared'` as `false`, short-circuits the AND, and skips API key validation entirely.
# Reproduction
1. Deploy LettaBot with default `shared` conversation mode.
2. Send unauthenticated GET requests to `/api/v1/pairing/:channel` and `/api/v1/status`.
3. Observe HTTP 200 responses containing pairing request data and agent metadata (agentId, conversationId, channels, baseUrl, timestamps).
4. Switch to `per-channel` mode and confirm the same requests return 401 Unauthorized.
# Impact
- Remote unauthenticated enumeration of management-plane metadata including pairing state and internal agent status.
- Exposes deployment topology, active channels, conversation identifiers, and service base URLs.
- Assists follow-on targeting by revealing internal infrastructure details. |
|---|
| Fonte | ⚠️ https://gist.github.com/YLChen-007/2ba2e586f3d16cb368c8dcd6ef680178 |
|---|
| Utente | JohnChen (UID 99088) |
|---|
| Sottomissione | 18/06/2026 08:50 (2 mesi fa) |
|---|
| Moderazione | 05/08/2026 20:44 (2 months later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 386359 [letta-ai LettaBot 0.2.0 API Status Route src/api/server.ts autenticazione debole] |
|---|
| Punti | 20 |
|---|