Openchamber
Monthly
Unauthenticated remote shutdown of OpenChamber 1.11.7 is possible by sending a single POST request to /api/system/shutdown, terminating the server process and instantly denying service to all active AI coding sessions. The flaw stems from the /api/system/shutdown route being registered before the authentication middleware in the Express handler chain within bootstrap-runtime.js, meaning authentication is never evaluated for that endpoint regardless of whether UI_PASSWORD is configured. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack requires no privileges or user interaction and is trivially reproducible against any network-exposed instance.
Unauthenticated arbitrary file read in OpenChamber 1.11.7 lets remote attackers pull any file off the host by setting the allowOutsideWorkspace=true query parameter with an absolute path against the /api/fs/read, /api/fs/stat, and /api/fs/raw endpoints. Because the workspace boundary check in resolveReadPathFromContext relies on a vacuous isPathWithinRoot guard, attackers can harvest the JWT signing secret, SSH private keys, and API credentials, then forge session cookies to fully bypass authentication on password-protected deployments. Reported by VulnCheck with an upstream fix committed; no public exploit identified at time of analysis.
Unauthenticated remote code execution in OpenChamber 1.11.7 lets remote attackers run arbitrary OS commands by POSTing to the /api/fs/exec endpoint, which hands input directly to Node.js spawn() with no allowlist, blocklist, or argument sanitization. Because the authentication middleware silently no-ops when UI_PASSWORD is unset - the state of the default Docker deployment - the endpoint is reachable without credentials and returns full stdout, stderr, and exit code to the attacker. Reported by VulnCheck; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the flaw is trivially exploitable.
Unauthenticated remote shutdown of OpenChamber 1.11.7 is possible by sending a single POST request to /api/system/shutdown, terminating the server process and instantly denying service to all active AI coding sessions. The flaw stems from the /api/system/shutdown route being registered before the authentication middleware in the Express handler chain within bootstrap-runtime.js, meaning authentication is never evaluated for that endpoint regardless of whether UI_PASSWORD is configured. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack requires no privileges or user interaction and is trivially reproducible against any network-exposed instance.
Unauthenticated arbitrary file read in OpenChamber 1.11.7 lets remote attackers pull any file off the host by setting the allowOutsideWorkspace=true query parameter with an absolute path against the /api/fs/read, /api/fs/stat, and /api/fs/raw endpoints. Because the workspace boundary check in resolveReadPathFromContext relies on a vacuous isPathWithinRoot guard, attackers can harvest the JWT signing secret, SSH private keys, and API credentials, then forge session cookies to fully bypass authentication on password-protected deployments. Reported by VulnCheck with an upstream fix committed; no public exploit identified at time of analysis.
Unauthenticated remote code execution in OpenChamber 1.11.7 lets remote attackers run arbitrary OS commands by POSTing to the /api/fs/exec endpoint, which hands input directly to Node.js spawn() with no allowlist, blocklist, or argument sanitization. Because the authentication middleware silently no-ops when UI_PASSWORD is unset - the state of the default Docker deployment - the endpoint is reachable without credentials and returns full stdout, stderr, and exit code to the attacker. Reported by VulnCheck; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the flaw is trivially exploitable.