Magebean Logo Magebean
← Back to Baseline

MB-0813

Partially automated Review sensitive anonymous REST declarations

MB-C20 Module Integrity & Compatibility Medium

Flag selected modules’ global webapi.xml anonymous routes with export, download, credentials, permissions, roles, or secrets path segments. Development inspects source declarations without claiming activation; other profiles require enabled modules.

Overview

Review anonymous REST declarations with sensitive path segments. Determine whether guest access is intended, inspect authorization and ownership checks, then test authorized and unauthorized requests in staging.

Why it Matters

Anonymous routes with sensitive path names deserve review because guest access may cross the intended data boundary.

Interpret the reported resource and collection scope before making changes. Unsupported source, unresolved symbols and bounded collection gaps cannot establish a clean result.

Verification Steps

Manual Verification

  1. Review anonymous REST declarations with sensitive path segments. Determine whether guest access is intended, inspect authorization and ownership checks, then test authorized and unauthorized requests in staging.
  2. Inspect the reported file, declaration, package or evidence record in the same selected release. Keep source observations separate from effective runtime behavior.
  3. Apply the rule-specific remediation below, validate the affected behavior in staging, and rerun the same selection.

Command / Review Sample

php magebean.phar audit --path=/var/www/magento --profile=module-integrity --rules=MB-0813 --modules=Vendor_Module

Use the assessed Magento project and the appropriate application or read-only review account. Replace example hosts, paths and identifiers with the assessment scope; configuration and source fragments are illustrative.

Remediation / Fix Guidance

  1. Verify intended guest access and check authorization before returning sensitive data.
  2. Verify the corrected behavior in an authorized staging environment.
  3. Rerun MB-0813 against the same release, profile and relevant file/key/package scope; compare the new evidence and inspect any independent collection gaps.

Examples

Illustrative declaration/review examples, not recorded scan output. A pass example concerns only the stated predicate and supported collected scope.

Fail Example

GET /V1/vendor/secrets
Resource: anonymous
Sensitive anonymous declaration requires review.

Pass Example

GET /V1/vendor/secrets
Resource: Vendor_Module::secrets
The sensitive anonymous pattern is absent; verify real authorization separately.

Scope and Evidence Limits

Rule revision: 2. Target modes: LOCAL.

Flag selected modules’ global webapi.xml anonymous routes with export, download, credentials, permissions, roles, or secrets path segments. Development inspects source declarations without claiming activation; other profiles require enabled modules.

This is a bounded heuristic. Runtime restrictions, alternate guards and business intent can make the route benign.

Catalog coverage describes implementation capability, not a scan outcome. An incomplete manual review cannot establish that the criterion is satisfied.

References