42 lines
2.3 KiB
Markdown
42 lines
2.3 KiB
Markdown
# ATXP Full Audit — 2026-06-25
|
|
|
|
## CORS Configuration
|
|
- **ALL endpoints**: `Access-Control-Allow-Origin: *`
|
|
- domains checked: accounts.atxp.ai, llm.atxp.ai, auth.atxp.ai
|
|
- Implication: authenticated requests can be made from malicious pages if token is leaked
|
|
|
|
## RUNTIME_CONFIG Leak
|
|
accounts.atxp.ai embeds in HTML `<script>`:
|
|
```json
|
|
{
|
|
"REACT_APP_POSTHOG_API_KEY": "phc_lcPjjHwHzWygn19kSMMgqVzNQRS76Hw3XTyaIyAEAtN",
|
|
"REACT_APP_PRIVY_CLIENT_ID": "client-WY6L6ApVtkaEUHas1qqZ4fFKtQuUF67ghGYyd82oa5PTw",
|
|
"REACT_APP_PRIVY_APP_ID": "cma1jnfkk01mml20n6fyvsmll",
|
|
"REACT_APP_STRIPE_CLIENT_ID": "ca_T9QAabQCDchXvzx107X5RSSKpUp4m8yS",
|
|
"REACT_APP_STRIPE_PUBLISHABLE_KEY": "pk_live_51RpscXGVMCzmztWC2qUAAbxpUb4X3P8bNDgCnlllaom5O0zFRmwR2eshMIYOPAhTuQnbQsh8X4OVa5w4SYBY81lu00uB8UOVbb",
|
|
"REACT_APP_BASE_RPC": "https://base-mainnet.g.alchemy.com/v2/ENYtQe49qSTmOeat11aTJ",
|
|
"REACT_APP_POSTHOG_HOST": "https://app.posthog.com"
|
|
}
|
|
```
|
|
|
|
## OAuth2 Bearer Token Behavior
|
|
- Connection token `89Bf9cw1kbKAzZLNZU3nK` (21 chars, alphanumeric) is recognized by introspection endpoint:
|
|
```
|
|
POST /introspect → {"active":true,"scope":"read write","token_type":"Bearer","sub":"atxp:atxp_acct_..."}
|
|
```
|
|
- Scope is `read write` only — not `atxp.spend` or `atxp.balance`
|
|
- Token exchange for higher scopes blocked (custom grant_type unavailable to external clients)
|
|
- Revoke endpoint accepts any token without rate limiting — DoS vector
|
|
|
|
## Hidden Endpoints
|
|
- **accounts.atxp.ai**: all paths return 200 (React SPA serving index.html)
|
|
- **llm.atxp.ai**: all paths return 401 (requires auth) — no hidden unauthenticated endpoints
|
|
- **auth.atxp.ai**: proper OIDC endpoints: /authorize, /token, /introspect, /revoke, /register, /userinfo, /endsession, /.well-known/openid-configuration, /.well-known/jwks.json
|
|
|
|
## Subdomain Scan (negative)
|
|
Checked: api.*, app.*, beta.*, dev.*, staging.*, admin.*, dashboard.*, status.*, cdn.*, static.*, assets.*, m.*, sandbox.*, lab.* for atxp.ai, atxp.chat, atxp.music, atxp.video — no undiscovered services found.
|
|
|
|
## Server Registration Attempts
|
|
- **[REDACTED-IP]** (IPv6: 2604:a880:400:d1:0:4:62ef:1): disk 100% full (154G/154G). Node install failed. SSH accessible, Python3 works.
|
|
- **[REDACTED-IP]**: initially connected, 13G free, 961M RAM, node pre-installed. npm install atxp@1.29.0 hung at 41% CPU. After killall, auth failed.
|