Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[BUG]: IDOR : Missing Ownership Check in ConcedeDebate

Aperta Adatta ai principianti
  • Qualcosa non va?
#772 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
75/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
docker, go, mongodb, redis
Ambito
api, backend, security

Direzione di ricerca

Leggi backend/controllers/debatevsbot_controller.go, ConcedeDebate (lines 529-661). Trova come l'email del chiamante viene recuperata dal Gin context, poi limita il FindOne alla linea 557 e l'update filter alla linea 564 per far corrispondere anche debate.Email == caller email. Esegui TestBUG05_IDOR_ConcedeDebate o assert un 403 per cross-user concede. Fatto significa che un attaccante ottiene 403 e il debate del proprietario rimane invariato.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug
Bug Description

POST /vsbot/concede accepts a debateId and updates the corresponding debates_vs_bot document to outcome: "User conceded" without verifying that the debate belongs to the authenticated caller.

In backend/controllers/debatevsbot_controller.go:557, the lookup is scoped only by _id:

err = db.DebateVsBotCollection.FindOne(
    context.Background(),
    bson.M{"_id": objID},
).Decode(&debate)

and the update at backend/controllers/debatevsbot_controller.go:564 is likewise unscoped:

filter := bson.M{"_id": objID}
update := bson.M{"$set": bson.M{"outcome": "User conceded"}}

No comparison is made between debate.Email and the authenticated user's email. Any authenticated user who obtains or guesses another user's debateId can force-concede that debate, overwrite its history with attacker-supplied content, and have a loss transcript/gamification applied to the attacker's own account.

Steps to Reproduce
  1. Start MongoDB (and Redis) with Docker:
    docker start debateai-mongo-1 debateai-redis-1
  2. Start the backend and authenticate two users: [email protected] and [email protected].
  3. As the owner, start a bot debate via POST /vsbot/create and record the returned debateId.
  4. As the attacker, call the concede endpoint with the owner's debateId:
POST /vsbot/concede
Authorization: Bearer <attacker_token>
Content-Type: application/json

{
  "debateId": "<OWNER_DEBATE_ID>",
  "history": [{"sender": "User", "text": "Attacker injected history"}]
}
  1. Observe the response and the owner's document:
    db.debates_vs_bot.findOne({_id: ObjectId("<OWNER_DEBATE_ID>")})
    // outcome: "User conceded", history replaced by attacker-supplied history
    Automated reproduction used a temporary test (TestBUG05_IDOR_ConcedeDebate) that inserts an owner-owned debate, authenticates as the attacker, and posts the owner's debateId to ConcedeDebate.
Logs and Screenshots
=== RUN   TestBUG05_IDOR_ConcedeDebate
    zz_bug05_idor_tmp_test.go:125: [email protected] [email protected] debateId=6adcc1ec0534e1a1696b0b8f
    zz_bug05_idor_tmp_test.go:126: HTTP status=200 body={"message":"Debate conceded successfully"}
    zz_bug05_idor_tmp_test.go:127: owner debate outcome after attacker request="User conceded" history=1 messages
    zz_bug05_idor_tmp_test.go:136: BUG CONFIRMED: attacker conceded another user's debate (HTTP 200, outcome="User conceded")
--- PASS: TestBUG05_IDOR_ConcedeDebate (0.10s)
PASS
ok  	arguehub/controllers	0.116s

Additional observed side effect: the attacker received +10 points for a loss in the gamification update (updateGamificationAfterBotDebate), because the handler applies the concession to the caller's account rather than the debate owner.

Environment Details
  • OS: Linux (x86_64)
  • Go: go1.24
  • Framework: Gin Gonic v1.9.1
  • Database: MongoDB 7.0 (debateai-mongo-1, port 27017)
  • Cache: Redis 7-Alpine (debateai-redis-1, port 6379)
  • Affected endpoint: POST /vsbot/concede
  • Affected file: backend/controllers/debatevsbot_controller.go (ConcedeDebate, lines 529–661; vulnerable lookup line 557, update line 564)
  • Severity: High (Broken Access Control / IDOR)
Impact

High - Major feature is broken

Code of Conduct
  • I have joined the Discord server and will post updates there
  • I have searched existing issues to avoid duplicates
Lingua principale
TypeScript
Stelle
104
Fork
244
Merge medio
1g 22h
PR unite (30g)
42

Preparare l'ambiente

  • Include un Dockerfile o un file Docker Compose
  • Nessun modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di AOSSIE-Org/DebateAI

Tutte le issue di AOSSIE-Org/DebateAI

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.