ThreatCrush — Authorization and Module Loading

Summary

Source review and isolated HTTP verification focused on authorization boundaries, module loading and web application controls.

Document record

Author: Eduardo Camarillo [Noir0x63]
Published: 2026-08-14
Version: v1.0
Language: English

1. Scope and Method

Source review of the ThreatCrush monorepo combined with targeted HTTP verification in an isolated Podman container. The reviewed scope included the web, CLI and desktop applications plus Supabase migrations. CVSS v3.1 was used to record severity in the report.

2. Selected Findings

TC-01: RLS Update Policy (CVSS 9.9)

The Row Level Security (RLS) policy on user_profiles lacked a WITH CHECK expression. Any authenticated user could send an UPDATE payload setting is_admin = true, gaining unrestricted platform control.

Remediation verified in the reviewed version: WITH CHECK policy applied.

TC-32: Daemon Module Loading (CVSS 9.8)

The threatcrushd daemon dynamically imported unsigned modules installed from the public marketplace or arbitrary Git URLs. The advisory describes the daemon running as root; installation and import are the relevant trust boundaries. It does not demonstrate direct evaluation of code received from unauthenticated network sockets.

Remediation verified in the reviewed version: signed-module verification and non-root isolation.

Primary evidence: Relevant published advisory. The advisory records the affected versions and technical mechanism; a fix or retest requires separate evidence.