Submit #958032: bleenco Abstruse v2.1.0 Authentication Bypass, Path Traversal

This report describes two distinct vulnerabilities in Abstruse CI that, when combined, form a complete attack chain for arbitrary file read.

Vulnerability A: Path Traversal in Worker /cache Endpoint (CWE-22)：

In `server/api/worker/download_cache.go` (line 25), the `file` query parameter is used directly in `filepath.Join(config.DataDir, "cache", r.URL.Query().Get("file"))` without any sanitization. There is no `..` detection, no canonical path checking, and no base directory confinement. The resulting path is passed to `os.Open()` and file contents are streamed back to the attacker via `io.Copy(w, file)`.

Go's `filepath.Join` calls `filepath.Clean`, which resolves `..` at the path component level but cannot prevent relative path traversal. When the server's working directory is `/` (default Docker deployment), `filepath.Join("data/", "cache", "../../../../../../etc/passwd")` resolves to `../../etc/passwd`, which `os.Open` interprets relative to cwd `/`, ultimately resolving to `/etc/passwd`.

This endpoint requires Worker JWT authentication (`WorkerAuthenticator` middleware). An attacker who already possesses a valid Worker JWT can exploit this vulnerability to read arbitrary files on the server filesystem.

Vulnerability B: Hardcoded JWT Signing Secret (CWE-798)：

The JWT signing secret (`JWTSecret`) is hardcoded in the server configuration file `/abstruse/abstruse-server.json` with the value `fa27ef3ef6570e32a79e74deca7c1bc3`. This value is also injected as the environment variable `ABSTRUSE_AUTH_JWTSECRET`. The secret is identical across all deployments using the default configuration and can be discovered by any source code review or configuration inspection tool.

An attacker who obtains this secret can forge an arbitrary Worker JWT using HS256 with `id` and `addr` claims, bypassing authentication entirely.

Combined Attack Chain：

Individually, each vulnerability has limited impact:

* Vulnerability A requires an already-authenticated Worker JWT.

* Vulnerability B only leaks a signing key with no direct file access.

However, combining them forms a complete attack chain: the hardcoded JWTSecret (B) allows forging a Worker JWT, which unlocks the path traversal endpoint (A), which in turn can read the server configuration file to obtain database credentials and other secrets. Since the server runs as root in Docker, `/etc/shadow` is also readable for offline password cracking.

• Source: ⚠️ https://glacier-tarsal-711.notion.site/abstruse-worker_cache_path_traversal-3d0b25e24b368035a445c1f09b0b34f6?source=copy_link
• User: Zy0t1 (UID 100983)
• Submission: 09/03/2026 11:59 (2 months ago)
• Moderation: 10/11/2026 09:40 (1 month later)
• Status: Accepted
• VulDB entry: 416553 [bleenco abstruse up to 2.1.0 Cache Endpoint download_cache.go filepath.Join file path traversal]
• Points: 17