Unauthenticated Data Exposure in Book Management System Flask API

Executive Summary

The Book-Management-System has Flask API endpoints (/student, /record, /books, /find_stu_book, /find_not_return_book) missing authentication protection. These endpoints allow unauthenticated users to retrieve sensitive student data like PII and borrowing history by providing a sequential card_id.

Useful 0 Not Useful 0

Detection Guidance

Check if unauthenticated requests to endpoints like /student, /record, /books, /find_stu_book, or /find_not_return_book return sensitive data such as student PII or borrowing history. Use tools like curl to test these endpoints with sequential card_id values (e.g., curl http://target/student?card_id=1).

Inspect the Flask application code for missing @login_required decorators on these endpoints while confirming sibling routes like /search_student or /storage have the decorator.

Useful 0 Not Useful 0

Impact Analysis

An attacker could enumerate all student records by cycling through card_id values, exposing personal data and borrowing histories. This enables identity theft, privacy violations, or targeted phishing attacks against students.

Useful 0 Not Useful 0

Compliance Impact

This violates GDPR's data minimization and security principles by exposing PII without authorization. It also breaches HIPAA if student health-related data is involved, as unauthorized access to personal records is prohibited.

Useful 0 Not Useful 0

Mitigation Strategies

Add the @login_required decorator to all vulnerable endpoints (/student, /record, /books, /find_stu_book, /find_not_return_book) to enforce authentication. Ensure all sensitive routes require valid user sessions.

Restrict access to the API endpoints by implementing rate limiting or IP whitelisting to prevent enumeration of card_id values.

Update the application to remove or secure the test credentials (username: 201801, password: 123456) and replace them with strong authentication mechanisms.

Useful 0 Not Useful 0