Authentication Bypass in Cua computer-server via Environment Variable Misconfiguration

Cua computer-server versions before 0.3.42 suffer from a critical authentication bypass vulnerability. When the application environment is deployed without the CONTAINER_NAME environment variable, the service fails to initialize authentication mechanisms and defaults to binding on all network interfaces. This exposure allows unauthenticated remote actors to interact directly with the application's sensitive API endpoints on TCP port 8000. Successful exploitation provides unauthorized access to the run_command endpoint, enabling arbitrary command execution, unrestricted file system read and write operations, and the ability to initiate interactive PTY shell sessions. Given the service's default network-wide exposure and the severity of the impacted operations, this vulnerability poses a severe risk to host integrity and data confidentiality.

Attack Chain

1. Attacker performs network discovery to identify services listening on TCP port 8000.
2. Attacker probes the discovered target to confirm the presence of the Cua computer-server service.
3. Attacker identifies a misconfigured instance where the CONTAINER_NAME environment variable is missing.
4. Attacker sends an unauthenticated HTTP request to the /run_command endpoint.
5. The application skips authentication due to the missing environment variable check.
6. Attacker executes arbitrary system commands with the privileges of the application process.
7. Attacker initiates an interactive PTY shell or performs file read/write operations for exfiltration or persistence.

Impact

Successful exploitation allows unauthenticated remote attackers to achieve full system compromise. Impact includes arbitrary command execution with application-level privileges, unauthorized access to system files, and the establishment of interactive shell sessions. This can lead to complete data exfiltration, lateral movement within the network, or the deployment of persistent malware.

Recommendation

• Upgrade Cua computer-server to version 0.3.42 or later immediately to resolve the authentication initialization defect.
• Audit all running instances of Cua computer-server to verify the presence of the CONTAINER_NAME environment variable.
• Implement network-level segmentation to restrict access to TCP port 8000 to only trusted management subnets until patching is completed.
• Monitor webserver logs for HTTP requests directed to the /run_command endpoint from unauthorized IP addresses.