Security hardening: RCE, SSRF, IDOR, auth backdoor, firmware keys, replay, XSS, DoS

[anthonyonazure]

Summary

Four-round security audit and remediation. Fixes four critical and multiple high / medium severity issues spanning RCE, SSRF, auth bypass, firmware key exposure, replay attacks, path traversal, XSS, and DoS. All changes are scoped, tested (29 new unit tests, all passing), and documented per-commit.

Commits

• f29867c — round 1: RCE via eval() on Redis data, unauthenticated WebSocket IDOR on /v1/trigger/listen, XSS in OAuth templates, hardcoded plugin secrets
• ddd239b — round 2: ADMIN_KEY full-user impersonation backdoor, SSRF via OAuth setup_completed_url, MCUBOOT firmware signing + encryption keys committed, Stripe webhook replay, path traversal in 7 upload sinks, firmware body ast.literal_eval, hardcoded Firebase key, shared ENCRYPTION_SECRET default, Next.js 13.5.1 upgrade, eval() in migrations
• 6cf17d7 — round 3: SSRF guard extended to user / app webhook URLs (6 more sinks), create-time URL validation, Redis-backed rate limit, timing-safe hmac.compare_digest on all 16 admin endpoints, JSON-LD </script> escape on both frontends, plugin placeholder creds, test-docstring secret
• 43efb83 — round 4: Zip-bomb + zip-slip guard on /v1/import/limitless

CRITICAL findings addressed

1. RCE via eval() on Redis data

backend/database/redis_db.py called eval() on cached values 7 times (app reviews, geolocation, usage counts, money-made cache). Any write to those Redis keys — via Redis exposure, SSRF-to-Redis, or upstream input that becomes a review/geolocation — executed arbitrary Python. Replaced with int() / float() / json.loads().

2. Unauthenticated WebSocket /v1/trigger/listen

uid was a query parameter with no token verification. Any attacker knowing a Firebase UID (leaks via shared conversations, plugin APIs, public stats) could connect and stream audio triggers / fake transcripts / process-conversation requests as the victim. Now requires Depends(get_current_user_uid_ws_listen).

3. ADMIN_KEY full-user impersonation backdoor

utils/other/endpoints.py verify_token accepted Authorization: Bearer <ADMIN_KEY><target_uid> and returned target_uid — anyone holding ADMIN_KEY could act as ANY user on every endpoint. A single env leak (CI logs, Kubernetes kubectl describe, misconfigured Grafana) = full platform compromise. Companion bug: LOCAL_DEVELOPMENT=true fell through to return '123' on any invalid token. Both now gated behind a dual check (LOCAL_DEVELOPMENT=true AND ENV != prod), so production rejects both shortcuts. Existing server-to-server admin endpoints (ADMIN_KEY == secret_key header check) are unaffected.

4. MCUBOOT signing + encryption private keys committed

omi/firmware/bootloader/mcuboot/root-rsa-2048.pem (signing key) and enc-rsa2048-priv.pem (image encryption key) lived in the repo. Anyone with either can sign arbitrary firmware that passes bootloader verification on deployed devices, and can decrypt any encrypted image. Removed from tree; added .gitignore + README_KEYS.md explaining KMS-backed rotation.

HIGH findings addressed

• SSRF on every app-supplied URL fetch (OAuth setup_completed_url, app.enable webhook check, 6 user-webhook sinks, 3 app-integration sinks). New utils/other/ssrf_guard.py with DNS-resolve + RFC1918 / loopback / link-local / multicast / reserved / metadata reject, credential strip, HTTPS-only default, no-follow-redirects. Create-time validation in apps.py rejects poisoned URLs before they land in the DB.
• Stripe webhook replay — captured signed payload could re-fire paid_app() credits and subscription side-effects indefinitely. Added mark_event_processed_once(event.id) (Redis SET NX EX, 7-day window) at the top of /v1/stripe/webhook.
• Path traversal — 7 upload handlers wrote file.filename verbatim under _temp/. Sanitized via os.path.basename() + ULID/UUID prefix.
• Firmware update body parse — ast.literal_eval(is_legacy_dfu_str.capitalize()) over a GitHub release body. Replaced with explicit lowercase bool parse; fail-safe to legacy DFU.
• Hardcoded Firebase API key in desktop/run.sh — now required from env.
• In-memory IP rate limit gave N × declared on multi-replica deploys and reset on pod restart. Primary path now Redis Lua (shared across pods); local fallback only on Redis errors.
• Zip-bomb / zip-slip on /v1/import/limitless — caps at 2 GiB total / 50k entries / 50 MiB per file; rejects .. and absolute paths.

MEDIUM findings addressed

• web/admin Next.js 13.5.1 → 14.2.15 (CVE-2024-34351 SSRF in Server Actions, CVE-2024-46982 cache poisoning).
• Timing-safe ADMIN_KEY comparison — 16 endpoints used secret_key != os.getenv('ADMIN_KEY') (early-exit). Now hmac.compare_digest across the board; also rejects the empty-string-matches-empty-string case when ADMIN_KEY is unset (503).
• JSON-LD </script> XSS — generateStructuredData / JsonLd used plain JSON.stringify on user-supplied plugin fields; JSON.stringify does not escape <, >, &. Both frontends now emit \u003c / \u003e / \u0026 / \u2028 / \u2029.
• ENCRYPTION_SECRET default in .env.template — shipped with a real-looking omi_Zw... literal that copy-paste devs would have left in place, so dev / staging / prod risked sharing the same conversation-encryption key. Template now blank with a generator command in the comment.

LOW / hygiene

• Plugin sample scripts (drinking_app.py, manual-import/app.py) replaced literal your_openaikey_here / get_this_api_key_in_omi_app with env reads that fail closed.
• Integration-test docstring no longer embeds a real-looking encryption secret.
• eval(service_account_info) in migrations → json.loads.

Tests

29 new unit tests in backend/tests/unit/, all passing:

• test_ssrf_guard.py — 14 tests (loopback, link-local, AWS metadata, RFC1918, IPv6 variants, mixed-DNS response, scheme, credentials, allowlist, DNS failure)
• test_auth_admin_key.py — 5 tests (both bypasses rejected in prod, accepted only in dev)
• test_admin_key_timing_safe.py — 5 tests (unset key, empty secret, wrong secret, correct secret, constant-time smoke check)
• test_import_zip_bomb_guard.py — 5 tests (zip-slip, absolute path, entry count, total size, per-file size)

$ pytest tests/unit/test_ssrf_guard.py tests/unit/test_auth_admin_key.py \
         tests/unit/test_admin_key_timing_safe.py tests/unit/test_import_zip_bomb_guard.py -v
============================= 29 passed in 0.87s ==============================

Post-merge ops action required (cannot be fixed in code)

1. Rotate MCUBOOT keys — generate new RSA-2048 keys in KMS / HSM; ship a signed firmware rotation image to deployed devices before scrubbing old keys from git history.
2. Rotate ADMIN_KEY in all environments.
3. Rotate ENCRYPTION_SECRET if the old omi_Zw... template value was ever used (note: rotating makes existing encrypted data unreadable).
4. Firebase App Check review — the committed client API keys are only safe with App Check enforced and strict Security Rules.
5. git filter-repo to scrub the firmware keys + desktop/run.sh Firebase key + any secrets burned to history from round 1, then force-push.

Test plan

• Run backend unit suite: cd backend && pytest tests/unit/ -v
• Verify /v1/trigger/listen returns 1008 Invalid or expired token without a valid Authorization header
• Verify OAuth setup_completed_url rejects http://169.254.169.254/ at app create (422) and at app enable (400)
• Replay a captured Stripe webhook and confirm second attempt returns {"status":"ok","deduplicated":true}
• Upload a file with filename="../../../etc/passwd" and confirm it lands under _temp/apps/<ULID>_passwd
• Build web/admin with the upgraded Next.js (npm ci && npm run build)
• In staging with ENV=production + LOCAL_DEVELOPMENT=true, confirm Authorization: Bearer <ADMIN_KEY>some_uid returns 401

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR addresses four classes of security vulnerability: eval() on Redis data (RCE), unauthenticated WebSocket access (IDOR), template variable injection into JavaScript (XSS), and hardcoded API credentials. The auth, XSS, and secret-removal fixes are correct, but the Redis serialization change has a backward-compatibility gap that needs attention before rollout.

• P1 — Redis cache breakage on rollout: Existing entries were written with Python's str() (single-quoted repr), and the new json.loads() calls will raise JSONDecodeError on that data. set_app_review_cache has no exception handler, so every write attempt for a cached app with old-format data will throw until the key expires naturally.

Confidence Score: 4/5

Safe to merge after addressing the Redis backward-compatibility issue; all security fixes are directionally correct.

One P1 finding remains: json.loads() will fail on existing Python-repr Redis entries, and set_app_review_cache propagates that exception. The remaining findings are P2. Credential rotation is required but is an operational action, not a code change.

backend/database/redis_db.py — the json.loads() migration needs a backward-compat shim for existing cached entries.

Important Files Changed

Filename	Overview
backend/database/redis_db.py	Replaced eval() with int(), float(), and json.loads() — correct security fix, but breaks backward compatibility with existing Python-repr-formatted Redis entries (single-quoted keys), causing json.JSONDecodeError on cached data written by the old code.
backend/routers/pusher.py	Added Depends(auth_ws) to /v1/trigger/listen WebSocket endpoint — correctly derives uid from the Firebase token instead of an unauthenticated query parameter, closing the IDOR.
backend/templates/auth_callback.html	Switched JavaScript string injection from bare {{ var }} to {{ var
backend/templates/oauth_authenticate.html	Applied tojson filter to appId, state, and all Firebase config values in script context — correct XSS fix.
backend/templates/oauth_callback.html	Applied tojson to redirect_url in window.location.href assignment — correct JavaScript-context XSS fix.
plugins/iq_rating/main.py	Removed hardcoded OMI_APP_SECRET default — correct, but emits only a warning rather than failing fast, so the app starts without required credentials.
omi/firmware/scripts/devkit/play_sound_on_friend.py	Removed hardcoded Deepgram API key, but uses an empty-string default which silently passes until the API rejects the empty credential.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[WebSocket /v1/trigger/listen] --> B{auth_ws Depends}
    B -- valid Firebase token --> C[uid derived from token]
    B -- missing/invalid token --> D[WebSocketException 1008]
    C --> E[_websocket_util_trigger uid, sample_rate]

    F[Redis GET reviews key] --> G{data present?}
    G -- No --> H[reviews = empty dict]
    G -- Yes, new JSON format --> I[json.loads OK]
    G -- Yes, old Python repr format --> J[json.JSONDecodeError]
    I --> K[merge + json.dumps write]
    H --> K
    J --> L[exception propagates - cache not updated]

Loading

_{Reviews (1): Last reviewed commit: "fix: Critical security vulnerabilities" | Re-trigger Greptile}

[greptile-apps]

Backward-compatibility break: existing Python-repr data fails json.loads()

Old code used r.set(..., str(reviews)) (Python repr format, single-quoted keys) while the new code reads with json.loads(), which requires double-quoted JSON. Any existing Redis entries written by the previous code will raise json.JSONDecodeError here. Since set_app_review_cache has no try_catch_decorator, the exception propagates unhandled — every attempt to update a review for a user whose cached entry is still in the old format will fail until that Redis key expires.

The same applies to get_specific_user_review (line 173), get_app_reviews (line 224), get_apps_reviews (line 232), and get_cached_user_geolocation (line 287). A backward-compat read shim is needed:

def _safe_json_loads(raw):
    """Parse JSON or fall back to ast.literal_eval for legacy Python-repr data."""
    import ast
    try:
        return json.loads(raw)
    except (json.JSONDecodeError, ValueError):
        try:
            return ast.literal_eval(raw if isinstance(raw, str) else raw.decode())
        except Exception:
            return {}

Replace each json.loads(reviews) call with _safe_json_loads(reviews) until all old entries have expired from Redis.

[greptile-apps]

Silent failure instead of fail-fast for required credentials

A warning at module load time means the process starts successfully and appears healthy, but every request that calls the Omi API will fail at runtime when OMI_APP_SECRET is None — likely with an opaque TypeError or auth error rather than a clear startup message. Raising at startup is safer:

if not OMI_APP_ID or not OMI_APP_SECRET:
    raise RuntimeError("OMI_APP_ID and OMI_APP_SECRET must be set via environment variables")

[greptile-apps]

Empty-string default silently suppresses the missing-key error

os.getenv("DEEPGRAM_API_KEY", "") will let the script proceed until the Deepgram client rejects the empty key, producing a confusing auth error. Removing the default (or checking explicitly) gives a clear signal at script start:

deepgram_api_id = os.getenv("DEEPGRAM_API_KEY") or exit("DEEPGRAM_API_KEY env var is required")