Introduce Shared-Secret Authentication and Mitigate Node Registration SSRF (Fixed #22, #23)

[yulmwu]

Previously, there was no authentication mechanism for privileged APIs in either sbxlet or sbxorch, leading to issues such as #22. Additionally, a potential SSRF vulnerability in the orchestration layer during node registration (#23) was identified and addressed as part of this change.

#22 — Shared-Secret Authentication

sbxorch, sbxlet, and sbxctl now authenticate privileged APIs using a single static shared secret. Communication succeeds only if all three components are configured with the same secret.

• Configuration:

  • shared_secret in each config file
  • SBX_SHARED_SECRET environment variable
  • sbxctl additionally supports the --secret flag

• Outbound requests (sbxctl to sbxorch, sbxorch to sbxlet) include an Authorization: Bearer <secret> header

• Protected routes return 401 Unauthorized if the token does not match (using constant-time comparison)

• Public routes are limited to GET /healthz and /swagger/*

• Fail-closed behavior: sbxorch and sbxlet refuse to start if shared_secret is not configured

Note

mTLS and similar mechanisms were considered, but ultimately deemed unnecessary for the current scale of this project, so they have been deferred for now.

#23 — Node Registration SSRF Hardening

Node registration now rejects IP addresses that are:

• Unspecified
• Multicast
• Link-local (including the cloud metadata endpoint 169.254.169.254)

Loopback and private address ranges remain allowed, since they are valid node addresses.

Furthermore, unauthenticated node registration is now prevented through the authentication mechanism introduced in #22.

For more details, please refer to the changes included in this PR.

Contributors

• Kang Hee chan (Yeonba0918) - Missing Authentication on Privileged sbxorch and sbxlet HTTP Control APIs #22, Unrestricted Node Registration Enables Orchestrator-Side SSRF and sbxlet Proxying #23 (Vulnerability Reporter)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!