Summary
Several Flask API endpoints in the Book-Management-System do not enforce authentication, allowing unauthenticated remote users to access student personal information and book-borrowing records. Because card identifiers are sequential, an attacker may enumerate records across the student database by supplying different identifiers.
Affected context
The vulnerability occurs in Flask API routes that expose student and book information without the authentication protection applied to related endpoints. It becomes risky when these routes are reachable over a network, accept user-controlled card identifiers, and return records without verifying the caller's identity or authorization to access the requested data.
Exploit preconditions
- Attack surface: Network-accessible Flask API endpoints
/student,/record,/books,/find_stu_book, and/find_not_return_book - Required access: No authenticated account is required
- Trigger point: A request containing a student
card_id - Why exploitation is possible: The affected routes omit required authentication checks, and sequential card identifiers may allow broad record enumeration
Potential impact
- Unauthorized disclosure of student names and genders
- Exposure of card validity and debt status
- Disclosure of complete or partial book-borrowing histories
- Bulk harvesting of student records
- Privacy violations and possible regulatory or reputational consequences
General mitigation guidance
Mitigation generally focuses on enforcing authentication and authorization
consistently across every endpoint that exposes sensitive records.
Common defensive patterns include:
- Applying authentication middleware or decorators by default to protected API routes
- Enforcing object-level authorization so callers can access only permitted student records
- Reducing reliance on predictable identifiers for record lookup
- Minimizing returned fields and avoiding unnecessary exposure of personal data
- Using deny-by-default route policies and explicit exceptions for genuinely public endpoints
- Applying least-privilege access to service accounts and data stores
- Adding automated tests that verify unauthenticated and unauthorized requests are rejected
How teams detect issues like this
Organizations commonly detect missing authentication through:
- Static analysis and route inventories that identify handlers lacking authentication middleware
- Code review checks comparing sibling protected routes with newly added endpoints
- API security tests for unauthenticated access and object-level authorization failures
- Policy enforcement requiring authentication metadata on routes returning sensitive data
- Monitoring for repeated requests involving sequential or rapidly changing identifiers
Neutral automated code review tools may help identify inconsistent decorator or middleware usage.
