Security Vulnerabilities in AI-Reviewed iShortn Code

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://zeroquarry.com/research/security-vulnerabilities-in-ai-reviewed-code
• Blog Title: Security Vulnerabilities in AI-Reviewed iShortn Code
• Suggested Section: Pentesting Web — update IDOR, Mass Assignment CWE-915, and SSRF sections with cross-tenant ownership predicates, TypeScript runtime-validation pitfalls, redirect revalidation, and stored/second-order SSRF

🎯 Content Summary

The post documents a source-code security review of iShortn, a self-hosted, open-source URL shortener supporting custom domains, analytics, QR codes, password-protected links, bio pages, and a REST API. ZeroQuarry, a repository-level security analysis tool designed to trace authorization, tenant boundaries, deployment context, and complete attack paths, found 13 high-severity and 33 medium-severity...

🔧 Technical Details

Public identifiers combined with missing object authorization: In a multi-tenant API, authentication does not protect an object if the database lookup uses only attacker-controlled or public identifiers. If an endpoint selects a record using values such as domain and alias but omits the authenticated user or tenant ID, an attacker can authenticate with their own credentials and substitute identifiers belonging to another account. Test this by obtaining public identifiers from one tenant and using them in authenticated GET, PATCH, or DELETE requests from a second tenant. Every read and mutation must include an ownership predicate or operate on a record whose ownership was already authorized.

Mass assignment behind compile-time TypeScript types: A TypeScript interface or type annotation does not validate incoming JSON because it is removed at runtime. If a handler copies all body properties into an ORM or database ...

🤖 Agent Actions

Implemented updates in:

• src/pentesting-web/idor.md
  • Composite public identifiers, cross-tenant testing, ownership predicates, trusted-link takeover, and provider-vs-workspace authorization scope.
• src/pentesting-web/mass-assignment-cwe-915.md
  • TypeScript type-erasure pitfalls, strict runtime schemas, explicit update allowlists, and inconsistent mutation-path validation.
• src/pentesting-web/ssrf-server-side-request-forgery/README.md
  • Stored/second-order SSRF, fetch-time validation, redirect revalidation, IPv4-mapped IPv6 handling, and DNS-rebinding safeguards.

Added numbered citations to the original remediation commits and ZeroQuarry research.

Validation passed:

• git diff --check
• Reference/citation consistency
• Balanced Markdown fences
• All newly referenced URLs returned HTTP 200

mdbook build could not run because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://zeroquarry.com/research/security-vulnerabilities-in-ai-reviewed-code

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web — update IDOR, Mass Assignment CWE-915, and SSRF sections with cross-tenant ownership predicates, TypeScript runtime-validation pitfalls, redirect revalidation, and stored/second-order SSRF".

Repository Maintenance:

• MD Files Formatting: 1029 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0