mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 12:42:38 +00:00
Oliver Kieselbach
a4e37cc087
External security review (2026-05-08) flagged 5 issues against the MCP server's auth surface. All five are addressed in code; one (Bicep param additions) lives on disk only because infra/ is gitignored — the operator needs to redeploy with the new mcpPublicUrl + stateHmacKey parameters documented in the bicep header to put F3 fully into effect. #1 access-guard cache-key collision (Medium) Cache was keyed on UPN only. A forged JWT with a victim's UPN would hit a legitimate user's cached `allowed: true` and bypass the backend signature check for any MCP-local operation (tools/list, resources/ list etc.) plus burn the user's rate-limit budget. Fix: cache key is now `${upn}:${sha256(token)}`, so distinct tokens always require a fresh backend roundtrip. accessCache joins the 5-min cleanup tick to evict expired entries (cardinality went up). #2 /oauth/register DoS surface (Medium) Endpoint is unauthenticated per RFC 7591 and the registry was an unbounded in-memory Map at 0.5 GiB container budget. Per-IP rate- limit was rejected (cloud-proxy egress collisions — Zscaler etc.). Fix: route-level express.json({ limit: '8kb' }) registered before the global parser; map-size cap at 10_000 entries (~3 MB worst-case) → 503 when full; field-level caps on redirect_uris.length and client_name. TTL/LRU eviction is intentionally NOT enabled — documented as TODO(oauth-map-ttl) because it interacts with the manual /mcp reconnect flow. #3 OAuth base URL trusted X-Forwarded-* headers (Medium) Discovery, issuer, WWW-Authenticate, and `${baseUrl}/oauth/callback` were all derived from caller-supplied headers. Container Apps Ingress appends but does not strip X-Forwarded-Host, so a hostile client could spoof the issuer in /.well-known/oauth-authorization-server. Fix: startup warning when MCP_PUBLIC_URL is unset. The bicep file (gitignored) was also extended with a `mcpPublicUrl` param — operator must redeploy with that pinned to the Container App FQDN after the first deploy emits it as an output. #4 PKCE/state hardening (Medium) code_challenge was optional and only forwarded conditionally; code_verifier was never required at /oauth/token; state was bare base64url-JSON without integrity protection. Fix: /oauth/authorize now rejects requests without code_challenge or with code_challenge_method != S256 (the discovery doc already advertised S256-only). /oauth/token requires code_verifier for grant_type=authorization_code. state is HMAC-SHA256 signed with STATE_HMAC_KEY (env, fallback per-instance random), payload includes iat, /oauth/callback rejects tampered or >10-min-old state in constant-time compare. Bicep adds a secure `stateHmacKey` param; unset is acceptable for single-replica deployments. #5 Structured 5xx leak in error-handler (Low) ApiError.parsed branch flowed all 5xx detail (error / hint / exceptionType) through to the MCP client. exceptionType in particular leaks CLR class names that have no business reaching a downstream caller. Fix: status>=500 branch moved before the parsed-detail branch and applies generic-message sanitization to structured 5xx too. Only correlationId and errorCode survive — those are operational handles for an operator to pivot on, not internals. Tests: src/__tests__/security-guards.test.ts. The pre-existing "preserves structured 5xx" case is inverted to assert sanitization. 16 new tests cover the cache-key fix, the registry caps, and the state HMAC roundtrip / tamper / expiry / replay paths. 47/47 green under `vitest run src/__tests__/security-guards.test.ts`. The tools-*.test.ts integration suites still require AUTOPILOT_API_TOKEN to run (pre-existing). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Autopilot Monitor
Advanced monitoring and troubleshooting solution for Windows Autopilot deployments. Gain full visibility into every enrollment session with a detailed event timeline, fleet health dashboards, and session reporting. Define custom analysis rules to automatically detect issues and gather rules to collect targeted evidence. Retrieve diagnostics packages on demand, configure agent settings like auto-reboot behavior and automatic timezone adjustment — all managed centrally from the web dashboard.
Private Preview
Autopilot Monitor is currently running as a Private Preview. Visit autopilotmonitor.com to request access and learn more.
Overview
Autopilot Monitor provides real-time tracking, intelligent diagnostics, and automated troubleshooting for Windows Autopilot enrollment processes. It consists of:
- Bootstrap Script — PowerShell script deployed via Intune that starts monitoring early in the enrollment process
- Monitoring Agent — Lightweight .NET application that collects telemetry and evidence during enrollment
- Backend API — Azure Functions-based ingestion and processing pipeline
- Web Dashboard — Next.js application for real-time monitoring and fleet analytics
Architecture
For detailed information about the system architecture, components, and data flow, see Architecture Documentation.
Documentation
Full documentation is available at autopilotmonitor.com/docs
License
This project uses a split licensing model:
- MIT License — Agent (
src/Agent/) and Shared library (src/Shared/) — unrestricted use on end-user devices - AGPL-3.0 — Backend (
src/Backend/), Web Dashboard (src/Web/), and MCP Server (src/McpServer/) — server-side components remain open source
See LICENSE for full details.