Insufficient Authorization (Routes)

[ProZachJ]

Several of our routes need additional validation to check that the domain provided by the client is one that the user owns.

Vulnerable Routes

• [ ] https://github.com/DarkShield/daDashboard/blob/master/app/routes/router.js#L98
• [ ] https://github.com/DarkShield/daDashboard/blob/master/app/routes/router.js#L106
• [ ] https://github.com/DarkShield/daDashboard/blob/master/app/routes/router.js#L114
• [ ] https://github.com/DarkShield/daDashboard/blob/master/app/routes/router.js#L143

Route that did it correctly https://github.com/DarkShield/daDashboard/blob/master/app/routes/router.js#L125

[mattjay]

Your line numbers are messed up here since master has changed. can you update @ProZachJ

[ProZachJ]

These need a check to see if the domain sent is in req.session.user.sites

https://github.com/DarkShield/daDashboard/blob/master/app/routes/router.js#L73 https://github.com/DarkShield/daDashboard/blob/master/app/routes/router.js#L81 https://github.com/DarkShield/daDashboard/blob/master/app/routes/router.js#L89 https://github.com/DarkShield/daDashboard/blob/master/app/routes/router.js#L116

[mattjay]

• [x] domains.info
• [x] domains.attacks
• [x] domains.info.lastday
• [x] toggleAttack

[mattjay]

toggleAttack is going to take an extra step of looking up the request _id in the db and returning the hostname. then checking that hostname against the session.