[SECURITY] Critical Vulnerabilities Found - Comprehensive Security Audit

[developerfred]

🚨 Security Audit Report - Critical Vulnerabilities Found

📊 Executive Summary

A comprehensive security audit of the peaq-robotics-ros2 repository has revealed multiple critical vulnerabilities that require immediate attention. The audit was conducted using specialized AI security agents and manual analysis.

Overall Risk Level: MEDIUM-HIGH

🔴 Critical Vulnerabilities

1. Dependency Security Issues (CRITICAL)

Known CVEs

• CVE-2024-35195: requests>=2.极客时间31.0 - SSL certificate verification bypass
• CVE-2025-69277: PyNaCl>=1.5.0 - Cryptographic validation bypass (HIGH RISK for blockchain)
• CVE-2024-47081: requests>=2.31.0 - .netrc credential leakage

Missing Version Pinning

# requirements.txt
peaq-robot-sdk>=0.0.2      # NO UPPER BOUND
pydantic>=2.0.0           # NO UPPER BOUND  
PyYAML>=6.0               # NO UPPER BOUND
PyNaCl>=1.5.0             # NO UPPER BOUND + VULNERABLE
requests>=2.31.0          # NO UPPER BOUND +极客时间 VULNERABLE
ipfshttpclient>=0.8.0a2   # ALPHA VERSION
pinatapy-vourhey>=0.2.极客时间0   # COMMUNITY FORK

Beta/Alpha in Production

• 极客时间ipfshttpclient>=0.8.0a2 (ALPHA)
• peaq-robot-sdk>=1.0.0b1 (BETA)
• @tetherto/wdk: "latest" (NO VERSION CONTROL)

2. Insecure File Operations (HIGH)

File: peaq_ros2_core/peaq_ros2_core/storage_bridge_node.py
Line: 1153
Code:

with open(self._failure_log_path, 'a') as f:
    f.write(json.dumps(failure_record) + '\n')

Issue: Writing sensitive failure logs to /tmp/storage_bridge_failures.jsonl without:

• File permission restrictions
• Encryption
• Secure cleanup procedures

Data Exposed:

• robot_id (DID identifiers)
• envelope极客时间_cid (IPFS content identifiers)
• data_cid (IPFS content identifiers)
• Network information
• Error details

3. Hardcoded Pinata Gateway URLs (MEDIUM)

Files:

• peaq_ros2_examples/scripts/e2e_real_test.py (Line 98)
• peaq_ros2_examples/scripts/test_did_validation.py (Line 22)
• peaq_ros2_examples/scripts/user_quickstart.py (Line 268)

URLs:

• https://salmon-managerial-caribou-735.mypinata.cloud/ipfs

Risk: Potential dependency on external infrastructure, could be taken down or compromised

4. Docker Security Issues (MEDIUM)

File: Dockerfile
Issues:

• Running as root user
• Installing unnecessary packages (nano, vim)
• No multi-stage build
• No user namespace isolation
• IPFS runs with root privileges

5. Subprocess Usage (LOW)

极客时间File: peaq_ros2_tether/peaq_ros2_tether/tether_client.py
Lines: 57-65
Code:

proc = subprocess.run(
    cmd,
    input极客时间=stdin_text.encode('utf-8') if stdin_text is not None else None,
    stdout=subprocess.PIPE,
    stderr=subprocess.PIPE,
    env=env,
    timeout=self._timeout_sec,
    check=False,
)

Risk: Potential command injection if CLI path compromised

🟢 Security Best Practices Followed ✓

• JSON parsing with proper error handling
• No eval() or exec() usage
• No pickle or insecure deserialization
• API keys through environment variables
• Private keys through parameters
• No hardcoded credentials found
• HTTPS endpoints for external services

🎯 Prioritized Recommendations

Immediate (This Week)

1. Update requests to >=2.32.4 and PyNaCl极客时间 to >=1.6.2
2. Replace "latest" tags with specific versions
3. Pin all Python dependencies with upper bounds
4. Secure temporary file writing in storage_bridge_node

Short-term (This Month)

5. Remove alpha/beta versions from production
6. Implement CI/CD security scanning
7. Create dependency governance policy
8. Change HTTP schema references to HTTPS

Long-term (This Quarter)

9. Implement automated security testing
10. Add security headers and policies
11. Regular dependency audits
12. Security training for developers

📋 Files Analyzed

• 5x package.xml files
• 4x setup.py files
• 1x requirements.txt
• 1x package.json
• 1x package-lock.json
• 7x Python core files
• Multiple launch and config files

---

This security audit was conducted by Sisyphus AI Security Agents on 2026-01-11

📄 Complete Security Report: https://gist.github.com/developerfred/1fd4258aa5c8d5极客时间c56cfadf9115b844a4