[W-3] Reseller auto-spend to self-signed fake upstream advertisement
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 22/100
Research direction
Start by checking whether the finding still reproduces on current main, since the body says it was not re-verified after migration. The relevant code is upstream_session_manager/session.go around lines 325 and 374-399, where the kind-10021 allotment tag is trusted without signature or key checks and the gateway is contacted over plain HTTP. Done means either a confirmed reproduction with a fix that verifies session event signatures against an allowlist of gateway keys, or a written note that the issue no longer applies upstream.
Written by the indexing model from the issue text.
Description
Migrated from Amperstrand/tollgate-module-basic-go#72 as part of the fork retirement — OpenTollGate/tollgate-module-basic-go is the single source of truth; the fork issue carries the original discussion and any lab evidence. Retirement plan: #758.]
HIGH: Any interface-up event (including wired WAN DHCP) probes gateway :2121/. A self-signed (validly-signed but with untrusted key) kind-10021 advertisement naming a mint the router trusts triggers automatic, repeating real-token payments to the attacker's endpoint. The reported usage controls renewal pacing.
The attack flow: upstream_session_manager/session.go:325,374-399 uses plaintext HTTP and trusts the allotment tag without signature verification. This is network-triggered and requires no authentication.
Fix: Allowlist gateway keys and verify session events with signature validation.
Evidence: /home/ubuntu/src/tollgate_audit_report_2026-08-26.md §7, line 144
File references: upstream_session_manager/session.go:325,374-399
Migrated 2026-10-09. Applicability to current upstream main (4614ac2, post-rc1) was not re-verified during migration — confirming whether the finding still reproduces upstream is this issue's first task.
- Dominant language
- Go
- Stars
- 12
- Forks
- 14
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 235
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from OpenTollGate/tollgate-module-basic-go
-
Session event emits the customer's MAC address in the p tag — spec-invalid value on every payment responsePossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
OpenTollGate/tollgate-module-basic-go#949 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
OpenTollGate/tollgate-module-basic-go#833 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
OpenTollGate/tollgate-module-basic-go#813 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
OpenTollGate/tollgate-module-basic-go#804 ·
Maintainers usually reply within 1 day
-
go-battery needs an ndsctl on PATH: TestPurchaseSessionGuardHoldsThroughTheOutcomeUnknownWindow fails on bare hosts (passes with stub)Possibly taken @Amperstrand claimed this 5 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
OpenTollGate/tollgate-module-basic-go#726 · 2 comments ·
Maintainers usually reply within 1 day
All issues in OpenTollGate/tollgate-module-basic-go
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
documentation hacktoberfest priority: low skill: good first issue status: ready for dev
Difficulty 2/5 Half a day Newbie friendliness 85/100
hyperledger-labs/fabric-smart-client#2142 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
numberly/vault-db-injector#107 ·
Maintainers usually reply within 1 day
-
area/import kind/bug
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
Maintainers usually reply within 1 day
-
[DOC] Wrong sg_egress_ports range in the Terraform Databricks Guide for AWS Hub & Spoke with Network FirewallPossibly taken @akhil9tiet claimed this today. Opendocs
Difficulty 1/5 Under an hour Newbie friendliness 72/100
databricks/terraform-provider-databricks#6080 · 1 comment ·
Maintainers usually reply within 3 days