GHSA-xv8g-fj9h-6gmv Linkdave Missing Authentication on REST and WebSocket endpoints

• Go github.com/shi-gg/linkdave: < 0.1.5 → fixed in 0.1.5

The `linkdave` server does not enforce authentication on its REST and WebSocket routes in versions prior to `0.1.5`. Impact An attacker with network access to the server port can: • Connect to the WebSocket endpoint (`/ws`) and receive a valid `session_id` in the `OpReady` response. • Use that session to invoke all REST player controls on any guild corresponding to their session id[1]. • Enumerate server statistics and runtime information via the unauthenticated `/stats` endpoint (still public after the fix). [1] If on `>=0.1.0`, attackers are restricted to creating, controlling and deleting players created within their own session ID. Vulnerable Routes The following routes were entirely unauthenticated in `>= 0.0.1, = 0.1.5`. Server configuration (e.g. `compose.yml`): ```sh environment: LINKDAVE_PASSWORD: ${LINKDAVE_PASSWORD} ``` ```sh echo "LINKDAVE_PASSWORD=$(openssl rand -hex 16)" >> .env ``` To restart the stack, run ```sh docker compose up -d ``` TypeScript client (`0.1.5+`): The client automatically handles authentication. Pass the password when constructing the client: ```ts const linkdave = new LinkDaveClient({ nodes: [ { name: "main", url: process.env.LINKDAVE_URI, password: process.env.LINKDAVE_PASSWORD } ] }); ``` Workarounds If upgrading is not immediately possible, restrict network access to the server's port using a firewall so it is only accessible from trusted internal IP addresses.