| Title | github.com/Travisun/Opptrix Opptrix Server v0.4.0 Command Injection |
|---|
| Description | A self-hosted Opptrix server (open source, github.com/Travisun/Opptrix) exposes all API endpoints without authentication from first launch until the owner completes account setup, which is the default claimed:false state of a fresh deployment. In this setup window, POST /api/auth/setup is first-come-first-served: whoever reaches it first receives the single administrator account permanently, while the legitimate owner is locked out with HTTP 409.
The schedule API then accepts a job of kind shell_script whose argv may be ["node","-e","<arbitrary JavaScript>"]; the command blocklist only rejects shell wrappers and the exact -c / /c arguments. Running the job via POST /api/schedule/jobs/{id}/run executes that argv with the privileges of the service process, and a non-zero exit code routes the command's stdout into the run record, giving the attacker output readback (demonstrated with whoami, hostname, and reading the key-vault key file).
The APIs carry no CORS headers, but JSON POSTs against a locally running instance can be reached same-origin through DNS rebinding because the server performs no Host header validation, so a malicious web page can drive the entire chain against a victim's local deployment with no interaction beyond browsing.
Verified against v0.4.0 (current main branch, self-reported via /api/health) on Windows. Impact: permanent takeover of fresh deployments, arbitrary command execution with service privileges, and command output disclosure; the executed code reaches the data directory including the user database and key vault.
Advisory / Exploit（三行，Drive 链接换成你自己的）：
https://github.com/Travisun/Opptrix
[Google Drive link - POC video]
[Google Drive link - POC html]
---
提交 2 — 漏洞2（更新包导入 → 重启后任意代码执行）
┌───────────────────┬──────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ 字段 │ 填写 │
A self-hosted Opptrix server (open source, github.com/Travisun/Opptrix) exposes all API endpoints without authentication from first launch until the owner completes account setup, which is the default claimed:false state of a fresh deployment. In this setup window, POST /api/auth/setup is first-come-first-served: whoever reaches it first receives the single administrator account permanently, while the legitimate owner is locked out with HTTP 409.
The schedule API then accepts a job of kind shell_script whose argv may be ["node","-e","<arbitrary JavaScript>"]; the command blocklist only rejects shell wrappers and the exact -c / /c arguments. Running the job via POST /api/schedule/jobs/{id}/run executes that argv with the privileges of the service process, and a non-zero exit code routes the command's stdout into the run record, giving the attacker output readback (demonstrated with whoami, hostname, and reading the key-vault key file).
The APIs carry no CORS headers, but JSON POSTs against a locally running instance can be reached same-origin through DNS rebinding because the server performs no Host header validation, so a malicious web page can drive the entire chain against a victim's local deployment with no interaction beyond browsing.
Verified against v0.4.0 (current main branch, self-reported via /api/health) on Windows. Impact: permanent takeover of fresh deployments, arbitrary command execution with service privileges, and command output disclosure; the executed code reaches the data directory including the user database and key vault.
|
|---|
| Source | ⚠️ https://drive.google.com/drive/folders/1-ENuA8hKauFSTrn55IRYPQBeKwMV9xwR?usp=sharing |
|---|
| User | fifker (UID 101353) |
|---|
| Submission | 09/19/2026 15:03 (1 month ago) |
|---|
| Moderation | 10/24/2026 02:49 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 426050 [Travisun Opptrix 0.4.0 Schedule API /api/auth/setup command injection] |
|---|
| Points | 20 |
|---|