Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
txthinking/brook
master @ 5cd13ef
4
Fixes
2
CVEs
CRITICAL
Peak severity
Highlights
Auth Bypass: 2 prior fixes. Scrutinize any change in this area.
cli/brook/main.go: most-fixed (2 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The administration web endpoints for the transparent proxy lacked password authentication entirely, exposing the service to unauthorized administrative control. Developers must ensure all newly introduced administration endpoints run through a centralized authentication middleware.
Auth Bypass: An authentication and resource lifecycle leak occurred in Authman where the authorization context was not properly terminated upon TCP/UDP handle closure. This allows unauthorized data transfer or lingering session access.
Insecure Temporary File: Storing the web dashboard password file in a world-writable `/tmp` directory exposes the credentials to local privilege escalation attacks. Passwords and administrative keys must be written strictly to secure, user-restricted directories like `/root`.