TLS SNI accepts arbitrary hostnames and performs unbounded certificate generation

Severity: High. An unauthenticated client that can reach the TLS listener can send a unique SNI hostname for every handshake. packages/portless/src/certs.ts:791-887 only special-cases the bare localhost name, then accepts every other servername without checking configured TLDs, registered routes, or wildcard policy. On each cache miss, packages/portless/src/certs.ts:681-771 invokes OpenSSL three times and persists a private key and certificate under host-certs; the in-memory cache and on-disk files have no size, lifetime, or rate bound. The callback is wired into the live secure proxy at packages/portless/src/cli.ts:3365-3372 and packages/portless/src/proxy.ts:710-725. Reproduction: pnpm dlx tsx /tmp/sni-repro.ts returned {"arbitrarySniAccepted":true,"generatedFiles":["another-attacker_example-key.pem","another-attacker_example.pem","attacker_example-key.pem","attacker_example.pem"]} for two unconfigured names. Repeated unique names therefore consume CPU and OpenSSL subprocess capacity and grow persistent state, providing a denial of service and disk exhaustion path. Remote reachability is confirmed for explicitly enabled LAN mode because packages/portless/src/cli-utils.ts:219-222 binds to 0.0.0.0 and ::; the normal non-LAN mode is loopback-only, which limits remote attackers. Suggested fix: reject SNI names outside validated configured TLDs and registered or explicitly wildcard routes before any filesystem or OpenSSL work, and enforce bounded certificate caching, cleanup, and handshake or generation rate limits.

Source: Maintainer job Security · run 0d1f884e-5550-4d54-a9a2-b193f46d8a28 · repository vercel-labs/portless.

Audited commit: 1ad573bb95810daf6cd50c1718707015450f3f09.