Crabbox EUVD-2026-29197

Attacker must possess valid authenticated user credentials with low-privilege access to the Crabbox coordinator - remote unauthenticated exploitation is not possible (PR:L in CVSS vector). The shared HMAC-SHA256 signing secret used for user token verification must be accessible to the attacker, either through application configuration files, environment variables, memory dumps, or reverse engineering of the token issuance process. Target Crabbox instance must be running a version prior to 0.9.0 with the vulnerable verifyUserToken() implementation. Admin-restricted coordinator routes must be network-accessible from the attacker's position, though no special firewall rules or VPN access beyond normal user connectivity is required (AV:N). Attack complexity is low (AC:L) once these prerequisites are met, requiring only JWT manipulation skills and HMAC signing capability. No user interaction required (UI:N). Exploitation is LIMITED by the initial authentication requirement - attackers without any Crabbox account cannot exploit this vulnerability remotely.

Real-world risk is HIGH for multi-tenant Crabbox deployments. CVSS 8.8 (AV:N/AC:L/PR:L/UI:N) accurately reflects network accessibility with low attack complexity once low-privilege credentials are obtained. The PR:L (low privileges required) constraint means attackers need initial authentication, reducing risk compared to unauthenticated RCE but still presenting significant exposure in environments where non-admin user accounts exist (customer portals, shared research infrastructure, CI/CD platforms). EPSS data not provided, but the technical characteristics suggest moderate exploitation likelihood: attack requires understanding of JWT structure and access to HMAC signing keys, but no memory corruption or race conditions. No CISA KEV listing indicates no confirmed active exploitation as of analysis date. SSVC assessment: Exploitation status = POC (commit diff reveals attack mechanics), Automatable = YES (token forging scriptable once credentials obtained), Technical Impact = TOTAL (admin access grants full coordinator control). Priority justified by scope of admin capabilities: cross-tenant data access violates isolation boundaries, forced release operations enable denial of service, and pool management could enable resource exhaustion or cost manipulation. Greatest risk in SaaS/multi-tenant configurations where customer isolation depends on token-based authorization.

An attacker obtains valid low-privilege Crabbox user credentials through phishing, credential stuffing, or compromised CI/CD service accounts. They intercept or decode their legitimate user token to understand the JWT structure and identify the HMAC-SHA256 signing key (possibly extracted from application configuration or memory). The attacker crafts a modified token payload inserting 'admin: true', recalculates the HMAC-SHA256 signature using the shared secret, and presents the forged token to coordinator admin routes. The vulnerable verifyUserToken() function validates the signature and grants full admin access, allowing the attacker to enumerate all active leases across tenants, manipulate resource pool states to cause service disruption, or force-release competitors' compute resources.