Path Traversal Vulnerability in Whistle

Whistle, an HTTP proxy tool, is susceptible to a path traversal vulnerability identified as CVE-2026-55629. The flaw resides in the service.js file, specifically within the /cgi-bin/temp/get route. The application implements a regex check (TEMP_FILE_RE) intended to restrict file access to a designated directory; however, the validation logic is flawed. If the provided filename parameter does not match the expected pattern, the application fails to reject the request. Instead, it processes the unsanitized user-supplied input directly, enabling the retrieval of arbitrary files outside of the intended directory. This vulnerability affects Whistle versions prior to 2.10.3 and poses a significant risk as it allows an unauthenticated remote attacker to read sensitive system files, such as /etc/passwd or /etc/hosts, simply by supplying a path as a query parameter.

Attack Chain

1. Attacker performs reconnaissance to identify a server running an outdated version of Whistle (v < 2.10.3).
2. Attacker probes the /cgi-bin/temp/get endpoint to determine if path traversal is possible.
3. Attacker constructs a malicious HTTP GET request targeting the /cgi-bin/temp/get endpoint.
4. Attacker injects a path traversal sequence or an absolute path (e.g., /etc/passwd) into the 'filename' query parameter.
5. The application's service.js router receives the request and evaluates the filename against the regex.
6. Due to the flawed logic, the regex fails to catch the malicious input and passes the unsanitized filename to the getFile function.
7. The application reads the requested file from the filesystem.
8. The application returns the contents of the unauthorized file in the HTTP response body, leading to information disclosure.

Impact

Successful exploitation of this vulnerability results in unauthorized access to sensitive files on the server hosting the Whistle proxy. This can lead to the exposure of credentials, configuration files, system identity details, and other sensitive information. The vulnerability affects any server running Whistle version 2.10.3 or lower, which is commonly used in development and debugging environments.

Recommendation

• Upgrade the Whistle npm package to version 2.10.3 or later immediately to apply the patch for CVE-2026-55629.
• Audit existing logs for anomalous access to the /cgi-bin/temp/get endpoint, specifically looking for GET requests containing path traversal characters like "../" or absolute file paths.
• Deploy the provided Sigma rule to webserver logs to detect exploitation attempts targeting this endpoint.
• Implement network access controls to restrict access to the Whistle administration interface to trusted internal IP ranges only.