Unauthenticated remote uninstall in my own EDR agent, and the four other auth bugs that turned out to be the same bug

Sentora, a self-hosted SIEM/SOAR/EDR platform, contained a critical unauthenticated remote uninstall endpoint listening on all interfaces, allowing any LAN user to uninstall the agent by sending a POST request to /self_destruct. Additional vulnerabilities stemmed from a permissive authentication mode that accepted any non-empty X-Agent-Key header due to unset environment variables, enabling unauthorized command execution. The server also allowed unauthenticated reporting of containment action statuses, enabling attackers to mark actions as successful and deceive SOC operators. An LDAP injection vulnerability existed due to unsafe string formatting of the login filter with minimal input validation. Furthermore, eight routes lacked proper authorization checks, allowing any logged-in user to perform sensitive actions such as running playbooks or testing LDAP connections. All these issues originated from a fundamental flaw: relying on caller-supplied identity without proper validation or authorization enforcement. The author implemented fixes including strict authentication on all endpoints, moving the uninstall endpoint behind a specific enrollment key, escaping LDAP filters, implementing per-user and per-IP lockouts, ignoring untrusted X-Forwarded-For headers, and introducing automated AST-based tests to ensure authorization coverage on all routes.

The vulnerabilities allowed any user on the local network to uninstall the EDR agent remotely without authentication, effectively disabling endpoint protection. Attackers could execute arbitrary commands on endpoints due to permissive authentication. They could also manipulate containment action statuses to falsely indicate successful incident response, misleading security operators. LDAP injection could allow unauthorized directory queries or manipulation. Missing authorization on multiple routes permitted low-privileged users to perform sensitive administrative actions. Collectively, these flaws compromised the integrity, availability, and trustworthiness of the security platform, potentially exposing the network to undetected attacks and response failures.

The author has fixed all identified issues on the main branch of the Sentora project. These fixes include enforcing authentication on every agent endpoint using secure methods, restricting the uninstall endpoint behind a dedicated enrollment key, escaping LDAP filter inputs, implementing per-user and per-IP lockout mechanisms, ignoring untrusted X-Forwarded-For headers, and removing reliance on caller-supplied identity fields for authorization decisions. Additionally, an automated AST-based test now ensures all routes have explicit authorization checks or are explicitly marked public, preventing regressions. Users of Sentora should update to the latest main branch to obtain these fixes. Since this is a self-hosted project, operators must apply the update and review their deployment configurations to ensure environment variables and secrets are properly set. Patch status is confirmed fixed on main. No known exploits in the wild have been reported.