提交 #992174: Opptrix Opptrix Server v0.4.0 Code Injection

A self-hosted Opptrix server (open source, github.com/Travisun/Opptrix) provides an offline system-update facility with an import endpoint, POST /api/system-update/import, that accepts a multipart upload of two files: the update package and its sha256 checksum. The checksum is self-attested: it is supplied by a file uploaded at the same time as the package, so the two merely have to match each other. There is no digital signature or trusted-source verification of the package. The only external cross-check, against the official CDN, runs solely when the uploaded version equals the CDN's latest version, so any version number the vendor never published bypasses it entirely (verified with 98.7.65).

While the instance is unclaimed, the default state of a fresh deployment, the import requires no authentication; and because a multipart POST and an empty-body POST are both CORS simple requests, any web page can deliver the attack blind from any origin. A follow-up POST /api/system-update/apply makes the process exit with the update exit code (42) exactly as it would before a supervisor restart. When the supervisor restarts onto the imported slot, it executes every hooks/post-activate/*.js file in the package with node, injecting all OPPTRIX_* environment variables.

This is arbitrary code execution with the service process's privileges. The hook receives the data-directory location through the environment without any reconnaissance, reaching the user database and key vault. Verified against v0.4.0 (current main branch) on Windows with a package built entirely in the browser, whose post-activate hook ran an attacker-chosen command and wrote its output to a proof file.

• 来源: ⚠️ https://drive.google.com/drive/folders/1ni6zbp75v4803pGCG_GGZwEkA0CtaLjl?usp=sharing
• 用户: fifker (UID 101353)
• 提交: 2026-09-19 15時29分 (1 月前)
• 管理: 2026-10-24 02時49分 (1 month later)
• 状态: 已接受
• VulDB条目: 426051 [Travisun Opptrix 0.4.0 Import Endpoint import 权限提升]
• 积分: 20