Threat Intelligence Database

GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274. FileServerHandler.channelRead0 in components/launchserver/src/main/java/pro/gravit/launchserver/socket/handlers/fileserver/FileServerHandler.java strips the first request-target character and resolves the remaining path against updatesDir without re-normalizing and verifying containment. This leaves parent-directory components in a no-leading-slash request and allows reading any file accessible to the LaunchServer process, including .keys/ecdsa_id, .keys/legacySalt, and LaunchServer.json. Disclosure of those files can expose signing keys, refresh-token material, and database credentials, enabling forged administrative access tokens and full authentication bypass. A normalizing L7 proxy may block the primary request form, but direct exposure and L4/TCP proxies remain affected, and netty.fileServerEnabled is enabled by default. This issue is fixed in 5.7.12.

### Summary `npx claude-code-templates --studio` launches "Claude Code Studio", an Express HTTP server (`cli-tool/src/sandbox-server.js`, default port 3444) that binds to **all interfaces** (`0.0.0.0`), sets `Access-Control-Allow-Origin: *`, and requires **no authentication**. Two POST endpoints pass attacker-controlled request-body fields into `child_process.spawn(..., { shell: true })`. Because `shell: true` makes Node join the argv array into a single `sh -c` string, the fields are parsed by the shell and metacharacters execute. Any unauthenticated attacker who can reach the port — a malicious web page the developer visits, or anyone on the same LAN — can execute arbitrary OS commands on the developer's machine. ### Details In `cli-tool/src/sandbox-server.js`: - `app.listen(PORT, ...)` is called with no host argument, so the server listens on `0.0.0.0` / `::` (reachable from the LAN, not just localhost). - The CORS middleware sends `Access-Control-Allow-Origin: *` and answers the preflight `OPTIONS` for any origin, so a browser will deliver cross-origin POSTs to it. - There is no authentication on any endpoint. The vulnerable sinks: 1. `POST /api/execute` — the `prompt` body field flows into `executeLocalTask()`: ```js const child = spawn('claude', [finalPrompt], { /* ... */ shell: true }); The only validation on prompt is a length check (>= 10 chars). With shell: true, finalPrompt is interpreted by the shell. 2. POST /api/install-agent — the agentName body field: const child = spawn('npx', ['claude-code-templates@latest', '--agent', agentName, '--yes'], { /* ... */ shell: true }); 2. agentName is used unvalidated. (The same unsafe pattern is also reachable through /api/execute's agent field via checkAndInstallAgent().) Root cause: spawn(cmd, argsArray, { shell: true }) does not keep argsArray as separate argv entries — Node builds cmd + ' ' + argsArray.join(' ') and runs it via sh -c, so every element is subject to shell parsing. PoC # Victim npx claude-code-templates --studio # server on 0.0.0.0:3444 # Attacker (another LAN host, or a malicious web page fetch(), or locally) curl -s -X POST http://127.0.0.1:3444/api/execute \ -H 'Content-Type: application/json' \ --data '{"prompt":"aaaaaaaaaa; touch /tmp/CCT_RCE_PROOF","mode":"local"}' curl -s -X POST http://127.0.0.1:3444/api/install-agent \ -H 'Content-Type: application/json' \ --data '{"agentName":"x; touch /tmp/CCT_AGENT_PROOF #"}' ls -la /tmp/CCT_RCE_PROOF /tmp/CCT_AGENT_PROOF # both created => injected commands ran The aaaaaaaaaa padding satisfies the 10-char minimum, then ; (or $(...), or backticks) starts the injected command. claude/npx do not even need to be installed — the injected segment runs regardless. Confirmed at runtime on v1.28.13 (Node 22, Linux): both marker files were created, the server listened on *:3444, and an OPTIONS preflight from Origin: https://evil.example returned 200 with Access-Control-Allow-Origin: *. Impact Unauthenticated remote code execution (CWE-78) on any machine running --studio. Two reachability paths: - Drive-by: a developer running --studio who visits an attacker-controlled web page — the page's cross-origin fetch() (Content-Type application/json) passes the wildcard CORS preflight and delivers the POST, achieving RCE with no other interaction. - LAN: because the server binds 0.0.0.0, anyone on the same network (office, co-working space, public Wi-Fi) can hit port 3444 directly. Impact is full compromise of the developer's user account (arbitrary command execution with the developer's privileges): source code, SSH keys, cloud credentials, and .env secrets. Suggested fix - Remove shell: true from all three spawns so arguments stay discrete argv entries (kills the injection). - Validate agentName against a strict allowlist (^[A-Za-z0-9._/-]+$). - Bind to loopback only (app.listen(PORT, '127.0.0.1', ...)). - Replace the wildcard CORS with a same-origin allowlist and reject other origins.

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. In a documented non-loopback deployment that relies on ipWhitelist, an unauthenticated adjacent-network client can connect directly to module Socket.IO namespaces, and js/node_helper.js dispatches arbitrary events and payloads to socketNotificationReceived. The default newsfeed and calendar helpers can make server-side requests to attacker-selected URLs, while the default updatenotification helper can reach child_process.exec when a third-party module update is pending and the attacker supplies an update command through the socket CONFIG path. This can expose internal services, manipulate module-helper state, and conditionally execute commands. This issue is fixed in version 2.37.0.

FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth in node/lib/auth.js and send crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, allowing arbitrary commands to execute as the asterisk service user. This issue is fixed in version 17.0.9.

## Summary There is a critical authentication-bypass vulnerability in Traefik's `ReplacePathRegex` middleware. When it is configured with a regular expression that captures user-controlled path segments without a mandatory separator (for example `regex: "^/api(.*)"`, `replacement: "/$1"`), a crafted request can produce an un-normalized replacement path such as `/../admin`, which Traefik forwarded to the backend without validation. A backend that normalizes the path may resolve it to a protected route, letting an unauthenticated attacker reach resources located behind authentication middleware. This is the same class of issue that was fixed for `StripPrefix` in CVE-2026-48020; that post-replacement normalization check had not been applied to `ReplacePathRegex`. The fix rejects any request whose replaced path does not match its normalized form. ## Patches - https://github.com/traefik/traefik/releases/tag/v2.11.52 - https://github.com/traefik/traefik/releases/tag/v3.6.23 - https://github.com/traefik/traefik/releases/tag/v3.7.7 ## For more information If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues). <details> <summary>Original Description</summary> ### Summary A path traversal vulnerability in the ReplacePathRegex middleware allows an unauthenticated remote attacker to bypass authentication middleware and access protected routes by sending a single crafted HTTP request. The vulnerability exists because ReplacePathRegex does not perform post-replacement path normalization validation - the same check added to StripPrefix in the fix for CVE-2026-48020 was not applied to ReplacePathRegex. ### Details When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g., `regex: "^/api(.*)"`, `replacement: "/$1"`), an attacker can inject implicit traversal sequences into the capture group. **Root cause:** `pkg/middlewares/replacepathregex/replace_path_regex.go`, function `ServeHTTP` (lines 56-74). After the regex substitution produces a new path, the middleware forwards it to the backend without checking whether the path normalizes differently - unlike StripPrefix which rejects such paths with HTTP 400 after the CVE-2026-48020 fix. **Attack flow:** 1. Attacker sends `GET /api../admin` 2. `sanitizePath` passes it unchanged (`api..` is a valid segment name, not a dot-segment) 3. Router matches `PathPrefix(/api)` → selects the public router (no auth middleware) 4. ReplacePathRegex applies `^/api(.*)` → captures `../admin` → replacement produces `/../admin` 5. No normalization check exists → path forwarded to backend as-is 6. Backend framework (Express, Flask, Django, Spring, ASP.NET) normalizes `/../admin` to `/admin` 7. Attacker receives protected content without authentication **Suggested fix:** Add the same JoinPath equality check after line 67: ```go if cleanPath := req.URL.JoinPath(); cleanPath.Path != req.URL.Path { http.Error(rw, http.StatusText(http.StatusBadRequest), http.StatusBadRequest) return } ``` ### PoC **Prerequisites:** Docker Engine 20.10+, Docker Compose v2, curl **1. Create `docker-compose.yml`:** ```yaml services: traefik: image: traefik:v3.7.6 command: - "--api.insecure=true" - "--providers.file.filename=/etc/traefik/dynamic.yml" - "--entrypoints.web.address=:80" ports: - "8080:8080" - "80:80" volumes: - ./dynamic.yml:/etc/traefik/dynamic.yml:ro healthcheck: test: ["CMD", "traefik", "healthcheck"] interval: 5s timeout: 3s retries: 5 backend: image: node:22-alpine working_dir: /app volumes: - ./server.js:/app/server.js:ro command: ["node", "server.js"] healthcheck: test: ["CMD", "wget", "-qO-", "http://localhost:3000/health"] interval: 5s timeout: 3s retries: 5 ``` **2. Create `dynamic.yml`:** ```yaml http: routers: public-api: rule: "PathPrefix(`/api`)" entryPoints: [web] middlewares: [rewrite-api] service: backend-svc priority: 1 protected-admin: rule: "PathPrefix(`/admin`)" entryPoints: [web] middlewares: [auth] service: backend-svc priority: 2 middlewares: rewrite-api: replacePathRegex: regex: "^/api(.*)" replacement: "/$1" auth: basicAuth: users: - "admin:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/" services: backend-svc: loadBalancer: servers: - url: "http://backend:3000" ``` **3. Create `server.js`:** ```javascript const http = require('http'); const path = require('path'); const server = http.createServer((req, res) => { const normalized = path.posix.normalize(req.url.split('?')[0]); res.setHeader('Content-Type', 'text/plain'); if (normalized === '/health') { res.writeHead(200); res.end('OK\n'); } else if (normalized === '/admin' || n

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName() function within webserver.js when self-signed certificates are in use. Attackers can open cross-origin WebSocket connections to any of the twelve WebSocket endpoints, send crafted action commands to exfiltrate the server sessionKey used to sign session cookies, forge session tokens as arbitrary users, and gain full remote control of all managed devices governed by the MeshCentral instance.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (560c3d47344d4da5dffac230236b5248d2f1856c221ffac7ff72d4e3b197957b) Package [email protected] is a credential/secret harvester disguised behind a benign-sounding name. scripts/postinstall-agent.mjs is a lifecycle-triggered agent that runs on `npm install` and performs host reconnaissance (ping/GET, id enumeration). dist/discordRelayUpload.js is an exfiltration channel that POSTs collected data using base64-encoded payloads to remote endpoints (Discord relay pattern). dist/secretScan/contentScanner.js and dist/secretScan/agentStartupAudit.js implement a secret-scanning pipeline that harvests credentials from the installer's filesystem and transmits results to hardcoded huggingface.co endpoints via fetch(). dist/hfCredentials.js carries base64-encoded credential material used to authenticate the exfil channel. dist/deploymentDefaults.js and scripts/encode-deployment.mjs contain base64-encoded configuration/payload data used by the agent. dist/relayServer.js implements a persistent relay component. The combination of an auto-executed postinstall agent + on-host secret scanning + base64-obfuscated payloads + hardcoded outbound POST/fetch to attacker-controlled relay endpoints satisfies the active-attack fingerprint for installer-side credential theft. ## Source: ghsa-malware (1deba1d29d0eb3668c5ca30605d3bb8578f3427835bd947c263c67b8728456ca) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

zredis-typed is a malicious npm package and part of the multi-wave "forge-jsx" cross-platform RAT campaign (Wave 4). It was published by npm account 'donimique' ([email protected]). The package.json description ('Node.js integration layer for Autodesk Forge') and the bundled README.md (literally titled "# forge-jsx") do not match the package name or the shipped code. On npm install the declared postinstall chain (postinstall-clipboard-event.mjs, ensure-dist.mjs, postinstall-durable-materialize.mjs, postinstall-bootstrap.mjs, postinstall-agent.mjs) runs scripts/postinstall-agent.mjs, which spawns dist/cli-agent.js as a detached, window-hidden background process. The agent connects over WebSocket to a command-and-control relay whose host, ports and default password are stored as an AES-256-GCM blob in dist/deploymentCipherData.js and decrypted at runtime by XOR-reconstructing a 32-byte key from two halves embedded in dist/deploymentDefaults.js. The decrypted C2 configuration is publicHost 212.193.3.61, relayPort 9877 (WebSocket relay), apiPort 8765 (HTTP API), default password 'secret'. Postinstall also registers OS-level autostart (Windows Run key, macOS LaunchAgent, Linux systemd/XDG autostart; service name forge-js-worker) pointing at a durable copy of the agent stored in a hidden '.forge-jsxy' directory under the platform application-data folder, so the implant survives removal of the npm package. Once running it performs credential-grade theft: dist/secretScan/agentStartupAudit.js walks the filesystem for BIP39-checksum-valid mnemonics, secp256k1/WIF private keys and BIP32 extended keys (xprv/tprv/zprv); dist/chromiumExtensionDbHarvest.js enumerates Chromium/Edge/Brave/Vivaldi/Yandex/Opera profiles across Windows, macOS and Linux and copies extension LevelDB stores (including MetaMask/Phantom-shaped wallet stores); harvested data is uploaded to the Hugging Face Hub using an embedded hf_ write token (dist/hfCredentials.js) or delivered via the relay; dist/hostInventorySend.js POSTs host inventory (hostname/platform/node/OS) to the relay and dist/discordRelayUpload.js forwards agent-side PNG screenshots to per-client Discord channels. This is the first wave of the campaign to ship rotated AES key material (new DEPLOYMENT_KEY_A/KEY_B/MASK_A/MASK_B byte arrays, hex 12335cede9edad1edbce89fd3ef0836c8edd3778e48f3f38f2330198ec8b1eb0), verified byte-identical across the four donimique-account packages (zod-pino434, zod-pino444, zredis-typed, pinokio-redis) — a single shared build. C2 212.193.3.61 (AS206216, Advin Services LLC, Nurnberg DE) is reused from the Wave 3 pino-zod/zod-pino IP rotation. The campaign is definitively linked by shared C2 infrastructure, the hardcoded '.forge-jsxy' durable directory, the dist/deploymentCipherData.js + dist/deploymentDefaults.js XOR-key fingerprint, and the '# forge-jsx' README tell that spans multiple package names and npm accounts. Only one version of zredis-typed (1.0.127) exists; all versions are malicious. Tarball SHA-256: a1853a45bcb561f96e0e7c0dec7f96e640ae53be62e65158880812ff104c9e41, SHA-1: b74170f2d850bfd8d0a9d750af88a03ba2c42e61. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (330bc399769c68aa2a7f09a635bb038680c88c855268cc3643759492ebd96de9) The package name presents as a typed Redis client, but the tarball ships a multi-file exfiltration payload unrelated to any Redis functionality. `dist/discordRelayUpload.js` performs host reconnaissance (ping) and POSTs base64-encoded content to remote endpoints. `dist/relayServer.js` similarly runs ping-based host probing. `dist/secretScan/agentStartupAudit.js` fetches attacker-controlled URLs on huggingface.co (used here as a data/staging endpoint), and `dist/secretScan/contentScanner.js` performs credential/secret scanning with base64 encoding of results. `dist/hfCredentials.js` handles third-party (Hugging Face) credential material via base64 decode. `dist/deploymentDefaults.js` and `scripts/encode-deployment.mjs` encode/decode deployment payloads via base64. `scripts/postinstall-agent.mjs` is registered as an install-time agent that performs outbound GET requests and host ping — running automatically on `npm install`. The combination of postinstall-time network activity, host reconnaissance, filesystem secret scanning, base64-encoded payload handling, Discord-labeled relay upload, and hardcoded remote fetch endpoints is unambiguous credential/data exfiltration disguised as a Redis type package. Nothing in the shipped modules implements a Redis client. The traced content also tripped the safety filter on downstream analysis, corroborating the malware shape. ## Source: ghsa-malware (73b8d51428450de7f67cb29aa402a94aefd62bdcf03e4f0eee43c554576eec2e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed,

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2dcf100385d43e4bb2e48489a99d1fc2d4f919953963fa0339966bd5270f61b3) All published JavaScript in dist/ (index.js, client.js, server.js, react.js, and sibling chunks) is heavily obfuscated using javascript-obfuscator (declared as a devDependency) with the hex-identifier and shuffled string-array dispatcher style. The package declares no preinstall/install/postinstall lifecycle hooks; no fetch-and-execute against remote hosts, no reads of installer-secret paths (~/.aws, ~/.ssh, ~/.npmrc, browser profiles), no enumeration of process.env, and no hardcoded credentials or attacker-controlled C2 endpoints were observed in the entry points reviewed. The 'ping/GET/id' keyword co-occurrence flagged in dist/server.js fires inside the obfuscated bundle and is not corroborated by any reachable exfiltration path in the files read. Obfuscation of the entire shipped surface makes the code unauditable and is a legitimate transparency concern for an 'ai-node-agent' library — reviewers should weigh maintainer trust before adopting — but on its own does not meet the threshold for a published block. ## Source: ghsa-malware (0730db02e46f4cfb224880f60bcdcdd43ed4d1bc97c68ee404428f7c592445cb) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (92ceffaf94fc190f70c18587857f2f0a674a9699512eec79f5cf738eefaa54ca) Package advertises itself as a pino+zod logging helper but ships content that does not match that purpose: a `dist/discordRelayUpload.js` module containing POST/upload code paths and base64 buffer handling, a `dist/relayServer.js` module, a `dist/secretScan/` tree (agentStartupAudit.js, contentScanner.js) that performs fetches against huggingface.co, a `dist/hfCredentials.js` with base64 decoding, a `dist/deploymentDefaults.js` with multiple base64 buffers, and a `scripts/postinstall-agent.mjs` containing GET/ping/id patterns. The presence of a `postinstall-agent.mjs` under `scripts/` is concerning as a possible install-time agent, and the shipped relay/upload/secret-scan modules suggest behavior far outside the declared logging-library scope. However, without traced execution context confirming whether postinstall-agent.mjs is actually invoked by a lifecycle hook, where the base64 blobs decode to, and whether the Discord/HuggingFace endpoints carry installer data outward, the intent cannot be conclusively classified. Routing to human review for inspection of package.json lifecycle hooks, the contents of deploymentDefaults.js base64 payloads, and the data flow into the Discord upload and HuggingFace fetch paths. ## Source: ghsa-malware (d57b4e49a62a8ca174c6c14820e5b101d042e3aea94438df19f9b12286a7cf30) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.