Listen to this Post
The vulnerability is a Time-of-Check-Time-of-Use (TOCTOU) race condition in the `/api/tunnel/register` endpoint. The code checks if a tunnel is a reconnection by querying the database. For new tunnels, it checks the current active count against the plan limit using Redis (scard). If the limit is not exceeded, it inserts a new tunnel record. However, the check and the insert are not atomic. An attacker can send multiple parallel registration requests simultaneously. Each concurrent request performs the limit check against the same Redis state before any request completes its insert operation. This allows all concurrent requests to see a count below the limit, pass the check, and each insert a new tunnel row, thereby exceeding the subscribed tunnel quota.
Platform: Outray
Version: Unknown
Vulnerability: TOCTOU Race Condition
Severity: Critical
date: Unknown
Prediction: Unknown
What Undercode Say:
tmux new-session -d -s "outray-race" tmux split-window -t "outray-race" -h tmux send-keys -t "outray-race" "outray 8090" C-m
const activeCount = await redis.scard(setKey);
if (activeCount >= tunnelLimit) { return error; }
await db.insert(tunnels).values(tunnelRecord);
How Exploit:
Send parallel tunnel registration requests simultaneously before Redis set updates.
Protection from this CVE:
Implement transactional locks or atomic operations combining check and insert.
Impact:
Bypass subscription limits, unauthorized resource usage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
