docs: scan #100 — Datus-ai/Datus-agent (1 real, issue #1415) - #140
Merged
Conversation
…ublic issue #1415) Legacy JWT auth surface (/auth/token, /workflows/run, /workflows/feedback) ships a hardcoded default signing secret and default client credentials that activate silently when ~/.datus/conf/auth_clients.yml is absent (the default install state — only the .example is committed). Server binds 0.0.0.0:8000 by default, so a reachable attacker can authenticate with the published default or forge a JWT signed with the published constant; either drives the NL→SQL agent. Invisible to all four tools (absence/default-value shape). Verified with a differential repro imported from the module verbatim, negative control included. Noise: 3 LiteLLM criticals are Proxy-only vs a client-library import; 79 raw/formatted-SQL are the NL→SQL engine layer (identifier FP, 11th appearance); 57 GHA hardening; all gitleaks hits in docs/samples/tests. Credited defenses: CORS disables credentials on wildcard, scoped-sub-agent 400s unknown names, bash sandbox fails closed, DuckDB enable_external_access=false. No SECURITY.md, PVR off, no org email — but the constant is already public in the repo, so a public issue leaks nothing. One focused de-branded issue filed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scan #100 of the public series. Target: Datus-ai/Datus-agent — a NL→SQL data-analysis agent (1.7k★, Apache-2.0, DatusAI Inc.), scanned at
c954fa4.291 findings, 1 real. The legacy JWT auth surface (
/auth/token,/workflows/run,/workflows/feedback) ships a hardcoded default signing secret ("your-secret-key-change-in-production") and default client credentials (datus_client/datus_secret_key) thatload_auth_configreturns silently whenever~/.datus/conf/auth_clients.ymlis absent — the default state of a fresh install, since only the.exampleis committed. Server binds0.0.0.0:8000by default, so a reachable attacker can authenticate with the published default or forge a JWT signed with the published constant; either token drivesservice.run_workflow→Agent→ SQL execution. Invisible to all four tools (absence/default-value shape). Verified with a differential repro imported from the module verbatim, negative control included.Filed one focused, de-branded public issue upstream: Datus-ai/Datus-agent#1415. No
SECURITY.md, PVR off, no org email — but the vulnerable constant is already committed publicly, so a public issue leaks nothing.Adds
docs/scans/datus-ai-datus-agent.html, prepends the index row + scan-log bullet, bumps 99→100.🤖 Generated with Claude Code