Security audit — 2026-06-12

[versila22]

Pentest mini-report — versila22/lima-app — 2026-06-12

Probed URL: https://limaimpro.duckdns.org/
Stack: React 18 + Vite 7 / npm (bun.lock also present) / PWA=yes (vite-plugin-pwa, workbox autoUpdate, SW scope /)
Counts: Critical=1 High=3 Medium=5 Low=2 Info=2

Findings

Sev	Cat	Title	Location
Critical	DAST/Dep	vitest arbitrary file read/exec via UI server (GHSA-5xrq-8626-4rwp, CVSS 9.8)	package.json (vitest <3.2.6)
High	Dep	fast-uri path traversal + host confusion (GHSA-q3j6-qgpj-74h6, GHSA-v39h-62p7-jpjc)	package-lock.json (fast-uri ≤3.1.1)
High	Dep	serialize-javascript RCE + DoS at build time (GHSA-5c6j-r48x-rmvq, GHSA-qj8w-gfj5-8c6v)	workbox-build chain
High	Dep	@babel/plugin-transform-modules-systemjs arbitrary code gen (GHSA-fv7c-fp4j-7gwp)	package-lock.json (7.12.0–7.29.0)
Medium	Dep	react-router open redirect via //path (GHSA-2j2x-hqr9-3h42)	package.json (react-router-dom ^6.30.1)
Medium	Dep	postcss XSS via unescaped </style> (GHSA-qx2v-qp2m-jg93)	package.json (postcss <8.5.10)
Medium	Dep	brace-expansion DoS in workbox-build (GHSA-jxxr-4gwj-5jf2)	workbox-build
Medium	Infra	nginx /assets/ location block strips all security headers	nginx.conf:28-31
Medium	SAST	JWT/access-token stored in sessionStorage (XSS-accessible)	src/lib/api.ts:45,53
Low	Infra	HSTS missing preload directive	nginx.conf:16
Low	Infra	CSP style-src 'unsafe-inline' allows CSS injection	nginx.conf:15
Info	PWA	SW pre-caches all HTML incl. auth routes; autoUpdate no prompt	vite.config.ts:65-67
Info	SAST	dangerouslySetInnerHTML in ChartStyle — developer-controlled CSS only	src/components/ui/chart.tsx:70

Top 3 fixes

1. vitest critical (GHSA-5xrq-8626-4rwp) — Pin vitest to >=3.2.6; never expose vitest --ui to the network.
2. react-router open redirect — Bump react-router-dom to >=6.30.4 via npm audit fix.
3. nginx /assets/ header stripping — Duplicate all add_header directives inside the /assets/ location block so CSP/HSTS/X-Frame-Options are preserved for static assets.

Evidence (Critical/High only)

Critical — vitest GHSA-5xrq-8626-4rwp

• Location: package.json devDependencies: "vitest": "^3.2.4" (resolves to <3.2.6)
• Snippet: "vitest": "^3.2.4" — affects all versions <3.2.6
• Impact: When vitest --ui server is listening (dev/CI), any network-reachable client can read arbitrary files from the host filesystem and potentially execute code. CVSS 9.8.
• Fix: Pin to vitest@>=3.2.6 and ensure vitest --ui is never exposed beyond localhost.

High — fast-uri ≤3.1.1 (two advisories)

• Location: package-lock.json transitive dep (workbox-build chain)
• Snippet: GHSA-q3j6-qgpj-74h6 (path traversal) + GHSA-v39h-62p7-jpjc (host confusion)
• Impact: Attacker-crafted URIs can bypass path checks or spoof authority; present in build toolchain.
• Fix: Update overrides["fast-uri"] to >=3.1.2 and run npm audit fix.

High — serialize-javascript (build-time RCE + DoS)

• Location: node_modules/@rollup/plugin-terser → node_modules/workbox-build
• Snippet: GHSA-5c6j-r48x-rmvq (RCE via RegExp/Date) + GHSA-qj8w-gfj5-8c6v (CPU DoS)
• Impact: Malicious input at build time could execute arbitrary code on the CI/build host.
• Fix: Verify overrides["serialize-javascript"] resolves to >=6.0.2 after npm audit fix.

High — @babel/plugin-transform-modules-systemjs (GHSA-fv7c-fp4j-7gwp)

• Location: package-lock.json transitive devDep (range 7.12.0–7.29.0)
• Snippet: Generates arbitrary code when compiled with malicious ESM input
• Impact: Compiling untrusted JS via Babel during build could execute arbitrary code on the build host.
• Fix: Add "@babel/plugin-transform-modules-systemjs": ">=7.29.3" to overrides, or run npm audit fix.

Verified safe

• No secrets in tracked source files; .env.production contains only VITE_API_URL (public Vite var)
• dangerouslySetInnerHTML in chart.tsx:70 injects only developer-defined CSS color variables, not user input
• No eval(), document.write, innerHTML assignments, or v-html directives in application source
• No postMessage listeners without origin checks (no postMessage usage found)
• No client-side JWT decode or client-side crypto for auth
• No prototype pollution patterns (no lodash, no unsafe Object.assign on user input)
• HSTS present with max-age=31536000; includeSubDomains
• X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy, Permissions-Policy all set
• Sensitive paths (.env, .git/config, .git/HEAD, backup.zip, dump.sql) all return 403
• TLS 1.0 and 1.1 disabled; TLS 1.2 and 1.3 enabled
• No VAPID private key in client-side code
• Token in sessionStorage (not localStorage); tab-scoped and cleared on tab close
• API cache uses NetworkFirst strategy — always attempts live network first

Needs server-side verification

• CORS policy on https://api-production-e15b.up.railway.app backend
• Backend rate limiting on /auth/login and /auth/forgot-password
• httpOnly and SameSite attributes on session cookies set by backend
• Backend JWT secret strength (JWT_SECRET=change_me_in_production placeholder in backend/.env.example)
• Whether vitest --ui is ever invoked in CI/CD or server environments
• Nginx /assets/ header stripping (DAST blocked by sandbox egress proxy — based on nginx.conf analysis)

Tools

ran=npm-audit, grep-secrets, curl-headers, curl-cors, curl-sensitive-paths, openssl-cert-dates, openssl-tls-protos, manual-SAST
skipped=none-missing; NOTE: all curl/DAST against limaimpro.duckdns.org returned HTTP 403 (host_not_allowed) from sandbox egress gateway — HTTP header findings based on nginx.conf analysis; TLS handshake completed before 403.

---

Generated by Claude Code

[versila22]

Audit update — 2026-06-12 (second pass, backend SAST)

A deeper backend review found 3 additional findings not in the initial report. Report updated on this branch.

Sev	Cat	Title	Location
High	SAST	Hardcoded seed admin credentials, no production guard	backend/app/main.py:53-121
Medium	SAST	Unauthenticated /health/db leaks DB URL prefix + table names	backend/app/main.py:202
Medium	SAST	DEFAULT_JWT_SECRET hardcoded in source	backend/app/config.py:10
Medium	SAST	CORS DEFAULT_CORS_ORIGINS includes localhost origins in production	backend/app/config.py:15

Most urgent: The seed data function creates admin@lima-impro.fr / Admin1234! on every fresh DB with no environment guard. Verify whether this account already exists in production and rotate if so.

Updated counts: Critical=1 High=5 Medium=5 Low=3 Info=2

---

Generated by Claude Code