The attestation-policy endpoint is not protected by admin autentication

Summary

Looks like that the attestation-policy endpoint is (was) not checking if the kbs-client submitting the request is actually authenticated (has the right key). This allows any kbs-client to actually change the attestation policy.

NOTE: this vulnerability is already fixed in #957

Details

kbs/src/api_server.rs line 196:

        "attestation-policy" if request.method() == Method::POST => {
            core.attestation_service.set_policy(&body).await?;

            Ok(HttpResponse::Ok().finish())

PoC

Submit a request to change the attestation policy with a wrong key and it should go through

Impact

This could allow anyone to change the attestation policy of trustee, which is pretty bad.