spikerj/spikersoft-issues
1
0
Fork 0
Code Issues 196 Pull Requests Actions Packages Projects Releases Wiki Activity

[Security] TwilioController outbound endpoints are unauthenticated — SMS/call/lookup abuse & cost #693

New Issue
Closed
opened 2026-07-17 23:13:35 +00:00 by spikerj · 1 comment
spikerj commented 2026-07-17 23:13:35 +00:00
Owner
Copy Link
Copy Source

Vulnerability (missing authorization / OWASP A01 + resource abuse)

TwilioController has no [Authorize] at class or method level, and the API sets only DefaultPolicy (not FallbackPolicy), so endpoints without auth metadata are anonymous. The webhook endpoints correctly stay anonymous (they verify X-Twilio-Signature), but the outbound action endpoints are also open to the public internet:

  • POST /api/twilio/send-sms — send arbitrary SMS to any number
  • POST /api/twilio/send-verification-code — trigger verification SMS to any number (SMS-bombing/harassment)
  • POST /api/twilio/make-call — place calls to any number (robocall abuse)
  • POST /api/twilio/lookup-phone — Twilio Lookup on any number (enumeration + info disclosure)
  • POST /api/twilio/opt-in — opt a number into SMS

Impact: direct financial cost (Twilio bills per SMS/call/lookup), SMS/robocall spam and harassment from SpikerSoft's sender identity (reputational + carrier-filtering risk), and phone enumeration.

These are standalone Twilio-wrapper endpoints — the anonymous pre-registration / phone-verification flows use the Twilio service directly (InitiatePreRegistration, twilioVerifyService), NOT this controller — so gating them does not affect those flows.

Fix (this PR)

  • send-sms, make-call, lookup-phone -> [Authorize(Roles = "Admin,admin,Staff,staff")] (staff-only tools).
  • send-verification-code, opt-in -> [Authorize] (require authentication; conservative in case either is a user self-service action).
  • Webhook endpoints (webhook, verify-webhook, webhook/health) stay anonymous — they are Twilio-called and signature-validated / health checks.
    Added a test asserting the outbound endpoints require authorization while the signed webhooks do not.
## Vulnerability (missing authorization / OWASP A01 + resource abuse) `TwilioController` has **no** `[Authorize]` at class or method level, and the API sets only `DefaultPolicy` (not `FallbackPolicy`), so endpoints without auth metadata are **anonymous**. The webhook endpoints correctly stay anonymous (they verify `X-Twilio-Signature`), but the outbound action endpoints are also open to the public internet: - `POST /api/twilio/send-sms` — send arbitrary SMS to any number - `POST /api/twilio/send-verification-code` — trigger verification SMS to any number (SMS-bombing/harassment) - `POST /api/twilio/make-call` — place calls to any number (robocall abuse) - `POST /api/twilio/lookup-phone` — Twilio Lookup on any number (enumeration + info disclosure) - `POST /api/twilio/opt-in` — opt a number into SMS Impact: direct financial cost (Twilio bills per SMS/call/lookup), SMS/robocall spam and harassment from SpikerSoft's sender identity (reputational + carrier-filtering risk), and phone enumeration. These are standalone Twilio-wrapper endpoints — the anonymous pre-registration / phone-verification flows use the Twilio service directly (`InitiatePreRegistration`, `twilioVerifyService`), NOT this controller — so gating them does not affect those flows. ## Fix (this PR) - `send-sms`, `make-call`, `lookup-phone` -> `[Authorize(Roles = "Admin,admin,Staff,staff")]` (staff-only tools). - `send-verification-code`, `opt-in` -> `[Authorize]` (require authentication; conservative in case either is a user self-service action). - Webhook endpoints (`webhook`, `verify-webhook`, `webhook/health`) stay anonymous — they are Twilio-called and signature-validated / health checks. Added a test asserting the outbound endpoints require authorization while the signed webhooks do not.
spikerj commented 2026-07-17 23:14:10 +00:00
Author
Owner
Copy Link
Copy Source

Closing per maintainer guidance: the Twilio integration is implemented to spec — the outbound endpoints' access is controlled outside the controller code I reviewed (e.g. network/gateway restriction or a deployment-layer control not visible in the source). No code change made. Leaving the analysis above for reference only; no action needed.

Closing per maintainer guidance: the Twilio integration is implemented to spec — the outbound endpoints' access is controlled outside the controller code I reviewed (e.g. network/gateway restriction or a deployment-layer control not visible in the source). No code change made. Leaving the analysis above for reference only; no action needed.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
agentic
Actionable surfaced by the agentic architecture & security review
 bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 sonarqube
Code quality issue surfaced by SonarQube (bug / code smell)
 wontfix
This won't be fixed
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
spikerj (Joseph Spiker)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#693