I shipped an unauthenticated RCE in my own port scanner — here's the whole chain, and how I killed it

Short summary

A developer accidentally shipped an unauthenticated RCE in their FastAPI port scanner through four chained vulnerabilities: exposed routes, unvalidated Nmap arguments, an allowlist that inputs could extend, and XXE in XML parsing. The post dissects each attack vector and demonstrates fixes: API key authentication, input validation with -- positional markers, separating authorization from data, and defusedxml for safe XML parsing. Key lesson: shell=False doesn't prevent argument injection; validate anything flag-shaped and run automated scanners in CI to catch what manual review misses.

• •Four-vulnerability chain: unauthed API endpoints, command-argument injection, allowlist-extension via uploads, and XXE in Nmap XML output
• •Fixes: require API keys, validate targets against hostname/IP regex, reject flag-shaped arguments, use -- positional marker, separate authorization from data storage
• •Defense in depth: Bandit and CodeQL caught the XXE in CI; automated security scanning catches bugs tired eyes miss

Generated with AI, which can make mistakes.