ge-aerospace/shopdb-flask
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add agent fingerprinting, client certificate auth, and security audit documentation
Some checks failed
CI / backend (push) Has been cancelled
Details
CI / naming (push) Has been cancelled
Details
CI / gates (push) Has been cancelled
Details
CI / frontend (push) Has been cancelled
Details
CI / lean-build (push) Has been cancelled
Details

Browse Source 
This commit adds:
- Database migrations for app_delta fingerprints and client certificates
- Scripts for certificate generation and fingerprint backfilling
- Comprehensive security audit reports and findings tracking
- Implementation documentation for certificate authentication
- Test utilities for certificate renewal and fingerprinting
- GE-ENFORCE collector fix documentation

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
Proudlock
2026-09-15 09:18:12 -04:00
parent 1a7bb9bd34
commit 5cd5332397
32 changed files with 8912 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
security-findings-unvalidated.csv Normal file
View File

@@ -0,0 +1,40 @@
Task,Category,Description,Estimated_Severity,Validation_Status,Notes
upload_employees_photo_1,File Upload,Employee photo upload validation,MEDIUM,Unvalidated,"Similar pattern to vuln #1 (Agent Binary Injection)"
upload_geenforce_payload_1,File Upload,GEEnforce payload upload (3 issues),HIGH,Unvalidated,"Similar pattern to vuln #1, multiple issues found"
upload_guides_image_1,File Upload,Guides image upload validation,MEDIUM,Unvalidated,"Similar pattern to vuln #1"
upload_printedparts_file_1,File Upload,Printed parts file upload validation,MEDIUM,Unvalidated,"Similar pattern to vuln #1"
upload_screenshot_magic_bypass_1,File Upload,Screenshot upload magic byte bypass,MEDIUM,Unvalidated,"Similar pattern to vuln #1"
upload_slides_multi_1,File Upload,Slides multi-file upload validation,MEDIUM,Unvalidated,"Similar pattern to vuln #1"
upload_warranty_proof_1,File Upload,Warranty proof upload validation,MEDIUM,Unvalidated,"Similar pattern to vuln #1"
scripts_body_upload_validation_1,File Upload,Scripts body upload validation,MEDIUM,Unvalidated,"Similar pattern to vuln #1"
ratelimit_apitoken_create_1,Rate Limiting,API token creation rate limiting,MEDIUM,Unvalidated,"Similar pattern to vuln #5 (Token Refresh Rate Limit Bypass)"
ratelimit_auth_change_password_1,Rate Limiting,Password change rate limiting,MEDIUM,Unvalidated,"Similar pattern to vuln #5"
ratelimit_guides_image_spam_1,Rate Limiting,Guides image upload spam protection,MEDIUM,Unvalidated,"Similar pattern to vuln #5"
ratelimit_printedparts_file_spam_1,Rate Limiting,Printed parts file upload spam,MEDIUM,Unvalidated,"Similar pattern to vuln #5"
ratelimit_scripts_upload_1,Rate Limiting,Scripts upload rate limiting,MEDIUM,Unvalidated,"Similar pattern to vuln #5"
ratelimit_setup_create_admin_1,Rate Limiting,Setup admin creation rate limiting,HIGH,Unvalidated,"Similar pattern to vuln #5, but affects admin creation"
ratelimit_warranty_proof_spam_1,Rate Limiting,Warranty proof upload spam,MEDIUM,Unvalidated,"Similar pattern to vuln #5"
endpoints_agentupgrade_race_1,Race Condition,Agent upgrade race condition,LOW,Unvalidated,"Similar pattern to vuln #7 (Event Dedup Race)"
endpoints_script_push_race_1,Race Condition,Script push race condition,LOW,Unvalidated,"Similar pattern to vuln #7"
race_computers_collector_1,Race Condition,Computers collector race condition,LOW,Unvalidated,"Similar pattern to vuln #7"
race_geenforce_collector_1,Race Condition,GEEnforce collector race condition,LOW,Unvalidated,"Similar pattern to vuln #7"
race_machines_collector_1,Race Condition,Machines collector race condition,LOW,Unvalidated,"Similar pattern to vuln #7"
race_measuringtools_collector_1,Race Condition,Measuring tools collector race condition,LOW,Unvalidated,"Similar pattern to vuln #7"
race_network_collector_1,Race Condition,Network collector race condition (2 issues),MEDIUM,Unvalidated,"Similar pattern to vuln #7, multiple issues"
race_printers_collector_1,Race Condition,Printers collector race condition,LOW,Unvalidated,"Similar pattern to vuln #7"
application_package_signed_check_1,Upload Validation,Application package signature verification,MEDIUM,Unvalidated,"Related to vuln #1 pattern"
maplevel_blueprint_upload_1,Upload Validation,Map level blueprint upload validation,MEDIUM,Unvalidated,"Similar to file upload issues"
models_image_upload_validation_1,Upload Validation,Models image upload validation,MEDIUM,Unvalidated,"Similar to file upload issues"
settings_branding_logo_upload_1,Upload Validation,Settings branding logo upload,MEDIUM,Unvalidated,"Similar to file upload issues"
apitoken_no_rotation_1,Token Management,API token non-rotation,MEDIUM,Unvalidated,"Similar pattern to vuln #4 (Refresh Token Non-Rotation)"
printedparts_kiosk_token_reuse_1,Token Management,Printed parts kiosk token reuse,MEDIUM,Unvalidated,"Similar pattern to vuln #4"
usb_kiosk_token_reuse_1,Token Management,USB kiosk token reuse,MEDIUM,Unvalidated,"Similar pattern to vuln #4"
collector_managed_token_timing_1,Timing Attack,Collector managed token timing attack,HIGH,Unvalidated,"Similar pattern to vuln #3 (Collector API Key Timing)"
setup_token_timing_1,Timing Attack,Setup token timing attack,MEDIUM,Unvalidated,"Similar pattern to vuln #3"
info_disclosure_application_exists_1,Info Disclosure,Application enumeration,LOW,Unvalidated,"Similar pattern to vuln #2 (Account Enumeration)"
collector_plugin_scoped_keys_1,Auth/Authz,Collector plugin-scoped keys,MEDIUM,Unvalidated,"Auth bypass or misconfiguration"
timing_geenforce_1,Timing Attack,GEEnforce timing attack,N/A,No Finding,"0 findings - not a vulnerability"
info_disclosure_asset_exists_1,Info Disclosure,Asset enumeration,N/A,No Finding,"0 findings - not a vulnerability"
info_disclosure_script_exists_1,Info Disclosure,Script enumeration,N/A,No Finding,"0 findings - not a vulnerability"
info_disclosure_user_exists_1,Info Disclosure,User enumeration,N/A,No Finding,"0 findings - not a vulnerability"
applications_installer_version_detect_1,Misc,Applications installer version detection,N/A,No Finding,"0 findings - not a vulnerability"
1 Task Category Description Estimated_Severity Validation_Status Notes
2 upload_employees_photo_1 File Upload Employee photo upload validation MEDIUM Unvalidated Similar pattern to vuln #1 (Agent Binary Injection)
3 upload_geenforce_payload_1 File Upload GEEnforce payload upload (3 issues) HIGH Unvalidated Similar pattern to vuln #1, multiple issues found
4 upload_guides_image_1 File Upload Guides image upload validation MEDIUM Unvalidated Similar pattern to vuln #1
5 upload_printedparts_file_1 File Upload Printed parts file upload validation MEDIUM Unvalidated Similar pattern to vuln #1
6 upload_screenshot_magic_bypass_1 File Upload Screenshot upload magic byte bypass MEDIUM Unvalidated Similar pattern to vuln #1
7 upload_slides_multi_1 File Upload Slides multi-file upload validation MEDIUM Unvalidated Similar pattern to vuln #1
8 upload_warranty_proof_1 File Upload Warranty proof upload validation MEDIUM Unvalidated Similar pattern to vuln #1
9 scripts_body_upload_validation_1 File Upload Scripts body upload validation MEDIUM Unvalidated Similar pattern to vuln #1
10 ratelimit_apitoken_create_1 Rate Limiting API token creation rate limiting MEDIUM Unvalidated Similar pattern to vuln #5 (Token Refresh Rate Limit Bypass)
11 ratelimit_auth_change_password_1 Rate Limiting Password change rate limiting MEDIUM Unvalidated Similar pattern to vuln #5
12 ratelimit_guides_image_spam_1 Rate Limiting Guides image upload spam protection MEDIUM Unvalidated Similar pattern to vuln #5
13 ratelimit_printedparts_file_spam_1 Rate Limiting Printed parts file upload spam MEDIUM Unvalidated Similar pattern to vuln #5
14 ratelimit_scripts_upload_1 Rate Limiting Scripts upload rate limiting MEDIUM Unvalidated Similar pattern to vuln #5
15 ratelimit_setup_create_admin_1 Rate Limiting Setup admin creation rate limiting HIGH Unvalidated Similar pattern to vuln #5, but affects admin creation
16 ratelimit_warranty_proof_spam_1 Rate Limiting Warranty proof upload spam MEDIUM Unvalidated Similar pattern to vuln #5
17 endpoints_agentupgrade_race_1 Race Condition Agent upgrade race condition LOW Unvalidated Similar pattern to vuln #7 (Event Dedup Race)
18 endpoints_script_push_race_1 Race Condition Script push race condition LOW Unvalidated Similar pattern to vuln #7
19 race_computers_collector_1 Race Condition Computers collector race condition LOW Unvalidated Similar pattern to vuln #7
20 race_geenforce_collector_1 Race Condition GEEnforce collector race condition LOW Unvalidated Similar pattern to vuln #7
21 race_machines_collector_1 Race Condition Machines collector race condition LOW Unvalidated Similar pattern to vuln #7
22 race_measuringtools_collector_1 Race Condition Measuring tools collector race condition LOW Unvalidated Similar pattern to vuln #7
23 race_network_collector_1 Race Condition Network collector race condition (2 issues) MEDIUM Unvalidated Similar pattern to vuln #7, multiple issues
24 race_printers_collector_1 Race Condition Printers collector race condition LOW Unvalidated Similar pattern to vuln #7
25 application_package_signed_check_1 Upload Validation Application package signature verification MEDIUM Unvalidated Related to vuln #1 pattern
26 maplevel_blueprint_upload_1 Upload Validation Map level blueprint upload validation MEDIUM Unvalidated Similar to file upload issues
27 models_image_upload_validation_1 Upload Validation Models image upload validation MEDIUM Unvalidated Similar to file upload issues
28 settings_branding_logo_upload_1 Upload Validation Settings branding logo upload MEDIUM Unvalidated Similar to file upload issues
29 apitoken_no_rotation_1 Token Management API token non-rotation MEDIUM Unvalidated Similar pattern to vuln #4 (Refresh Token Non-Rotation)
30 printedparts_kiosk_token_reuse_1 Token Management Printed parts kiosk token reuse MEDIUM Unvalidated Similar pattern to vuln #4
31 usb_kiosk_token_reuse_1 Token Management USB kiosk token reuse MEDIUM Unvalidated Similar pattern to vuln #4
32 collector_managed_token_timing_1 Timing Attack Collector managed token timing attack HIGH Unvalidated Similar pattern to vuln #3 (Collector API Key Timing)
33 setup_token_timing_1 Timing Attack Setup token timing attack MEDIUM Unvalidated Similar pattern to vuln #3
34 info_disclosure_application_exists_1 Info Disclosure Application enumeration LOW Unvalidated Similar pattern to vuln #2 (Account Enumeration)
35 collector_plugin_scoped_keys_1 Auth/Authz Collector plugin-scoped keys MEDIUM Unvalidated Auth bypass or misconfiguration
36 timing_geenforce_1 Timing Attack GEEnforce timing attack N/A No Finding 0 findings - not a vulnerability
37 info_disclosure_asset_exists_1 Info Disclosure Asset enumeration N/A No Finding 0 findings - not a vulnerability
38 info_disclosure_script_exists_1 Info Disclosure Script enumeration N/A No Finding 0 findings - not a vulnerability
39 info_disclosure_user_exists_1 Info Disclosure User enumeration N/A No Finding 0 findings - not a vulnerability
40 applications_installer_version_detect_1 Misc Applications installer version detection N/A No Finding 0 findings - not a vulnerability