Unauthenticated remote uninstall in my own EDR agent, and the four other auth bugs that turned out to be the same bughttps://www.reddit.com/r/netsec/comments/1vy9rkb/unauthenticated_remote_uninstall_in_my_own_edr
Sentora is my own project, so this is a postmortem on my own code, not someone else's. The agent shipped this: @/app.post("/self_destruct") async def self_destruct(request: Request): threading.Thread(target=perform_destruction, daemon=True).start() return sanic_json({"status": "Destruction initiated"}) No auth. Listening on 0.0.0.0:9099 . perform_destruction() ran rm -rf "$(pwd)" . One unauthenticated POST from anywhere on the subnet uninstalled the EDR. The four others: Permissive auth on by default. A _is_permissive_auth() helper accepted any non-empty X-Agent-Key when a specific env var wa…