RFC API endpoint is RCE-adjacent with no loopback/auth hardening #72

New issue

Open

opened 2026-09-04 15:37:48 +00:00 by mara · 0 comments

mara commented

2026-09-04 15:37:48 +00:00

Collaborator

Summary

api/rfc.py sets requires_auth = False, requires_csrf = False, and no requires_loopback gate. It forwards to runtime.handle_rfc() which performs importlib.import_module(module) + getattr(imp, function_name) — arbitrary function invocation. The only gate is an HMAC-SHA256 of RFC_PASSWORD, verified with a non-constant-time == comparison in helpers/rfc.py:verify_data.

Risk

If RFC_PASSWORD is weak or leaks, any host with network access to the WebUI port gets arbitrary function execution.

Suggested fix

Add requires_loopback gate (like api/scheduler_tick.py does).
Use hmac.compare_digest in helpers/crypto.py:verify_data.
Rate-limit failed verifications.

Files: api/rfc.py, helpers/rfc.py:44-67, helpers/crypto.py:12-13.
Found during code audit (follow-up to #69).

## Summary `api/rfc.py` sets `requires_auth = False`, `requires_csrf = False`, and no `requires_loopback` gate. It forwards to `runtime.handle_rfc()` which performs `importlib.import_module(module)` + `getattr(imp, function_name)` — arbitrary function invocation. The only gate is an HMAC-SHA256 of RFC_PASSWORD, verified with a non-constant-time `==` comparison in `helpers/rfc.py:verify_data`. ## Risk - If RFC_PASSWORD is weak or leaks, any host with network access to the WebUI port gets arbitrary function execution. ## Suggested fix 1. Add `requires_loopback` gate (like `api/scheduler_tick.py` does). 2. Use `hmac.compare_digest` in `helpers/crypto.py:verify_data`. 3. Rate-limit failed verifications. Files: `api/rfc.py`, `helpers/rfc.py:44-67`, `helpers/crypto.py:12-13`. Found during code audit (follow-up to #69).