| タイトル | notionnext-org NotionNext main branch Missing Authentication for Critical Function (CWE-306) |
|---|
| 説明 | NotionNext main branch contains a missing authentication vulnerability (CWE-306) on the /api/cache endpoint, allowing unauthenticated remote attackers to wipe the entire site cache and trigger persistent denial of service.
Vulnerability Overview
The authentication guard inside pages/api/cache.js uses short-circuit conditional logic `if (token && authHeader check)`. When the environment variable CACHE_REVALIDATION_TOKEN is unset (default deployment state), the `token` variable becomes undefined, and the entire authorization validation block is skipped with no fallback protection. Unauthenticated POST requests proceed to invoke cleanCache(), which uses fs.rmSync to recursively delete all cached site data without any access restriction. Other API routes in the same codebase implement proper fallback handling for missing tokens, proving the flawed guard pattern is an isolated security oversight.
Vulnerable Source Code Snippet
// pages/api/cache.js:13-16
const token = process.env.CACHE_REVALIDATION_TOKEN
if (token && req.headers.authorization !== `Bearer ${token}`) {
return res.status(401).json({ status: 'error', message: 'Unauthorized' })
}
Short-circuit evaluation bypasses all authentication checks when token is undefined.
// lib/cache/local_file_cache.js:86-89
export function cleanCache() {
fs.rmSync(CACHE_DIR, { recursive: true, force: true })
ensureCacheDir()
}
Dangerous sink function that fully erases the cache directory once the auth bypass succeeds.
Attack Vector
Attackers send an unauthenticated HTTP POST request to /api/cache with no Authorization header. In default deployments where CACHE_REVALIDATION_TOKEN is not configured, the server returns HTTP 200 OK and deletes all cached site assets instantly.
Impact
- Complete site cache erasure causing severe performance degradation;
- Persistent denial of service for all site visitors until cache rebuilds;
- Mass resource consumption during cache regeneration cycles.
Root Cause
The authentication logic lacks a mandatory hard block when the revalidation token environment variable is missing. The short-circuit && operator skips the authorization comparison entirely when token is undefined, with no else clause to reject anonymous requests. Other endpoints in the project implement secure fallback logic for missing secrets, confirming this is a broken security implementation.
Remediation Guidance
1. Rewrite the auth check to enforce authentication regardless of token presence; return 401 if CACHE_REVALIDATION_TOKEN is unset;
2. Mirror the secure guard pattern used in /api/claude/contribution-refresh.js;
3. Document mandatory configuration of CACHE_REVALIDATION_TOKEN in deployment guides;
4. Add rate limiting to the cache purge endpoint to mitigate repeated DoS abuse.
CVSS v3.1 Score: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Discoverer: Ordinaryzyx |
|---|
| ソース | ⚠️ https://github.com/notionnext-org/NotionNext |
|---|
| ユーザー | zyx122126 (UID 100375) |
|---|
| 送信 | 2026年08月10日 14:08 (2 月 ago) |
|---|
| モデレーション | 2026年09月27日 12:38 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 410874 [notionnext-org NotionNext 迄 4.10.10 Authentication Guard pages/api/cache.js cleanCache token 弱い認証] |
|---|
| ポイント | 20 |
|---|