Severity
Medium — Missing authorization + misleading "encrypted" analytics
Location
Backend/src/main/java/com/sandeep/eventrabackend/security/EncryptedAnalyticsController.java:12,32-42
Description
The encrypted-analytics compute endpoint:
- Has
@CrossOrigin(origins = "*") and no @PreAuthorize/role check, so it is reachable by any authenticated user (and from any origin).
- Takes a client-supplied
modulusN and returns homomorphicPropertyVerified: true unconditionally.
The server holds no use of a private key here, so no actual confidentiality is provided; the endpoint is effectively a public homomorphic calculator that also accepts unbounded ciphertexts (cheap DoS) and is open to all origins.
Impact
- Unbounded computation (DoS) open to any origin.
- False sense of privacy / "verified" analytics.
Suggested fix
Require appropriate role/event scoping, remove wildcard CORS, validate/limit input size, and only return verified when the server actually performed the verification.
Severity
Medium — Missing authorization + misleading "encrypted" analytics
Location
Backend/src/main/java/com/sandeep/eventrabackend/security/EncryptedAnalyticsController.java:12,32-42Description
The encrypted-analytics compute endpoint:
@CrossOrigin(origins = "*")and no@PreAuthorize/role check, so it is reachable by any authenticated user (and from any origin).modulusNand returnshomomorphicPropertyVerified: trueunconditionally.The server holds no use of a private key here, so no actual confidentiality is provided; the endpoint is effectively a public homomorphic calculator that also accepts unbounded
ciphertexts(cheap DoS) and is open to all origins.Impact
Suggested fix
Require appropriate role/event scoping, remove wildcard CORS, validate/limit input size, and only return
verifiedwhen the server actually performed the verification.