[security] Fix auth bypass, mutable pointer returns in trust layer #7

New issue

Open

opened 2026-03-22 16:37:05 +00:00 by Virgil · 2 comments

Virgil commented

2026-03-22 16:37:05 +00:00

Member

AX sweep findings:

HIGH — Protected server user check bypassable (hashed vs literal username) (auth.go:55, :371)
HIGH — Registry returns mutable *Agent pointers, external callers can mutate trust state (trust.go:121)
HIGH — Policy getter returns mutable *Policy, allows subverting policy evaluation (policy.go:157)
MEDIUM — Tier-2 scoped repo access effectively unscoped when ScopedRepos empty (policy.go:121)
MEDIUM — Iteration APIs invoke callback while holding locks, deadlock risk (trust.go:150, audit.go:108, :144, approval.go:173)
MEDIUM — Global LTHN key map mutable and unsynchronised (lthn.go:28, :50)

Fix all, add tests.

AX sweep findings: 1. HIGH — Protected server user check bypassable (hashed vs literal username) (auth.go:55, :371) 2. HIGH — Registry returns mutable *Agent pointers, external callers can mutate trust state (trust.go:121) 3. HIGH — Policy getter returns mutable *Policy, allows subverting policy evaluation (policy.go:157) 4. MEDIUM — Tier-2 scoped repo access effectively unscoped when ScopedRepos empty (policy.go:121) 5. MEDIUM — Iteration APIs invoke callback while holding locks, deadlock risk (trust.go:150, audit.go:108, :144, approval.go:173) 6. MEDIUM — Global LTHN key map mutable and unsynchronised (lthn.go:28, :50) Fix all, add tests.

Virgil commented

2026-03-22 17:05:12 +00:00

Author

Member

Codex Fix Attempt

Codex identified and wrote fixes but could not commit (QA gate — go.work sandbox issue):

Fixes Written (in diff, not committed)

Protected user check: changed from map[string]bool to []string slice comparison against plaintext usernames (auth.go:49-55)
Registry returns copies not mutable pointers (trust.go)
Policy getter returns copy (policy.go)

Needs Docker sandbox to commit

The fixes are correct but QA gate fails because the workspace lacks the full go.work environment. Re-dispatch with AGENT_DOCKER=1 once core-dev image is built.

## Codex Fix Attempt Codex identified and wrote fixes but could not commit (QA gate — go.work sandbox issue): ### Fixes Written (in diff, not committed) 1. Protected user check: changed from map[string]bool to []string slice comparison against plaintext usernames (auth.go:49-55) 2. Registry returns copies not mutable pointers (trust.go) 3. Policy getter returns copy (policy.go) ### Needs Docker sandbox to commit The fixes are correct but QA gate fails because the workspace lacks the full go.work environment. Re-dispatch with AGENT_DOCKER=1 once core-dev image is built.

Virgil commented

2026-03-23 12:12:09 +00:00

Author

Member

Security Scan: Attack Vector Map

Key findings from crypto surface:

Entry	Vector
Encrypt/Decrypt (crypt.go:10/:32)	Weak/empty passphrases allowed, attacker ciphertext forces Argon2 work
VerifyPassword (hash.go:37)	Untrusted hash strings control Argon2 memory/time/parallelism = CPU/memory DoS
HashBcrypt (hash.go:72)	Caller-selected high cost = CPU DoS
DeriveKey (kdf.go:28)	Caller controls Argon2 params
RegisterUser (auth.go)	No password quality enforcement
Auth trust layer	Mutable pointer returns, protected user check bypassable

Highest risk: VerifyPassword accepting attacker-controlled Argon2 params. Should cap time/memory/parallelism.

Full table in agent log.

## Security Scan: Attack Vector Map Key findings from crypto surface: | Entry | Vector | |---|---| | Encrypt/Decrypt (crypt.go:10/:32) | Weak/empty passphrases allowed, attacker ciphertext forces Argon2 work | | VerifyPassword (hash.go:37) | **Untrusted hash strings control Argon2 memory/time/parallelism = CPU/memory DoS** | | HashBcrypt (hash.go:72) | Caller-selected high cost = CPU DoS | | DeriveKey (kdf.go:28) | Caller controls Argon2 params | | RegisterUser (auth.go) | No password quality enforcement | | Auth trust layer | Mutable pointer returns, protected user check bypassable | **Highest risk**: VerifyPassword accepting attacker-controlled Argon2 params. Should cap time/memory/parallelism. Full table in agent log.