59 lines
2.8 KiB
Markdown
59 lines
2.8 KiB
Markdown
# LLM Proxy Security Audit Report
|
|
|
|
## Executive Summary
|
|
A comprehensive security audit of the `llm-proxy` repository was conducted. The audit identified **1 critical vulnerability**, **3 high-risk issues**, **4 medium-risk issues**, and **3 low-risk issues**. The most severe findings include Cross-Site Scripting (XSS) in the dashboard interface and insecure storage of provider API keys in the database.
|
|
|
|
## Detailed Findings
|
|
|
|
### Critical Risk Vulnerabilities
|
|
#### **CRITICAL-01: Cross-Site Scripting (XSS) in Dashboard Interface**
|
|
- **Location**: `static/js/pages/clients.js` (multiple locations).
|
|
- **Description**: User-controlled data (e.g., `client.id`) inserted directly into HTML or `onclick` handlers without escaping.
|
|
- **Impact**: Arbitrary JavaScript execution in admin context, potentially stealing session tokens.
|
|
|
|
#### **CRITICAL-02: Insecure API Key Storage in Database**
|
|
- **Location**: `src/database/mod.rs`, `src/providers/mod.rs`, `src/dashboard/providers.rs`.
|
|
- **Description**: Provider API keys are stored in **plaintext** in the SQLite database.
|
|
- **Impact**: Compromised database file exposes all provider API keys.
|
|
|
|
### High Risk Vulnerabilities
|
|
#### **HIGH-01: Missing Input Validation and Size Limits**
|
|
- **Location**: `src/server/mod.rs`, `src/models/mod.rs`.
|
|
- **Impact**: Denial of Service via large payloads.
|
|
|
|
#### **HIGH-02: Sensitive Data Logging Without Encryption**
|
|
- **Location**: `src/database/mod.rs`, `src/logging/mod.rs`.
|
|
- **Description**: Full request and response bodies stored in `llm_requests` table without encryption or redaction.
|
|
|
|
#### **HIGH-03: Weak Default Credentials and Password Policy**
|
|
- **Description**: Default admin password is 'admin' with only 4-character minimum password length.
|
|
|
|
### Medium Risk Vulnerabilities
|
|
#### **MEDIUM-01: Missing CSRF Protection**
|
|
- No CSRF tokens or SameSite cookie attributes for state-changing dashboard endpoints.
|
|
|
|
#### **MEDIUM-02: Insecure Session Management**
|
|
- Session tokens stored in localStorage without HttpOnly flag.
|
|
- Tokens use simple `session-{uuid}` format.
|
|
|
|
#### **MEDIUM-03: Error Information Leakage**
|
|
- Internal error details exposed to clients in some cases.
|
|
|
|
#### **MEDIUM-04: Outdated Dependencies**
|
|
- Outdated versions of `chrono`, `tokio`, and `reqwest`.
|
|
|
|
### Low Risk Vulnerabilities
|
|
- Missing security headers (CSP, HSTS, X-Frame-Options).
|
|
- Insufficient rate limiting on dashboard authentication.
|
|
- No database encryption at rest.
|
|
|
|
## Recommendations
|
|
### Immediate Actions
|
|
1. **Fix XSS Vulnerabilities:** Implement proper HTML escaping for all user-controlled data.
|
|
2. **Secure API Key Storage:** Encrypt API keys in database using a library like `ring`.
|
|
3. **Implement Input Validation:** Add maximum payload size limits (e.g., 10MB).
|
|
4. **Improve Data Protection:** Add option to disable request/response body logging.
|
|
|
|
---
|
|
*Report generated by Security Auditor Agent on March 6, 2026*
|