{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/@openhop/server-0.3.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@openhop/server (0.3.5)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":["OpenHop"],"content_html":"\u003cp\u003eThe @openhop/server package (0.3.5 and potentially surrounding versions) is affected by a path traversal vulnerability (CWE-22) originating from the unsafe construction of filesystem paths in \u003ccode\u003eFlowStore.filePath()\u003c/code\u003e. The application concatenates unsanitized HTTP route parameters directly into a \u003ccode\u003epath.join\u003c/code\u003e call without validation. Because the Fastify router (\u003ccode\u003efind-my-way\u003c/code\u003e) automatically decodes URL-encoded characters, an attacker can supply sequences such as \u003ccode\u003e..%2F\u003c/code\u003e to escape the intended \u003ccode\u003eOPENHOP_DATA_DIR\u003c/code\u003e directory.\u003c/p\u003e\n\u003cp\u003eThis vulnerability impacts both the read (GET) and delete (DELETE) operations of the \u003ccode\u003e/api/flows/:id\u003c/code\u003e endpoint. Furthermore, the application registers CORS with \u003ccode\u003eorigin: true\u003c/code\u003e, making local instances exploitable via malicious browser-based requests. Default Docker deployments binding to \u003ccode\u003e0.0.0.0\u003c/code\u003e allow direct unauthenticated network access, significantly increasing the risk of data exfiltration and file destruction for exposed instances.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker sends a crafted HTTP GET or DELETE request to the \u003ccode\u003e/api/flows/:id\u003c/code\u003e endpoint using a traversal payload (e.g., \u003ccode\u003e..%2Ffilename\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe Fastify \u003ccode\u003efind-my-way\u003c/code\u003e router decodes the URL-encoded \u003ccode\u003e%2F\u003c/code\u003e character into a literal \u003ccode\u003e/\u003c/code\u003e, resulting in an \u003ccode\u003eid\u003c/code\u003e parameter value of \u003ccode\u003e../filename\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eFlowStore.filePath()\u003c/code\u003e method receives the malicious \u003ccode\u003eid\u003c/code\u003e string.\u003c/li\u003e\n\u003cli\u003eThe method executes \u003ccode\u003epath.join(this.dir, '../filename.yaml')\u003c/code\u003e, which normalizes to a path outside the designated data directory.\u003c/li\u003e\n\u003cli\u003eThe application performs a file system operation (\u003ccode\u003ereadFile\u003c/code\u003e for GET or \u003ccode\u003eunlink\u003c/code\u003e for DELETE) on the resulting path.\u003c/li\u003e\n\u003cli\u003eThe server confirms the action by returning the contents of the target file or a success status for the file deletion.\u003c/li\u003e\n\u003cli\u003eThe attacker succeeds in either exfiltrating sensitive YAML-serialized information or permanently deleting application-critical files.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthenticated attackers to read or delete any \u003ccode\u003e.yaml\u003c/code\u003e file accessible to the user running the OpenHop process. Successful exploitation can lead to the exposure of sensitive application secrets or configuration data (Confidentiality) and the permanent loss of flow configurations (Integrity/Availability). Deployment environments with default Docker settings (\u003ccode\u003eHOST=0.0.0.0\u003c/code\u003e) are reachable directly from the internet, while local instances are vulnerable via cross-origin browser-based exploitation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003ePatch immediately by implementing an allowlist validation for the \u003ccode\u003eid\u003c/code\u003e parameter in \u003ccode\u003epackages/server/src/store.ts\u003c/code\u003e using a regex pattern (e.g., \u003ccode\u003e/^[A-Za-z0-9_-]+$/\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eIf an immediate update is not possible, restrict access to the \u003ccode\u003e/api/flows/\u003c/code\u003e endpoint via network-level firewalls or reverse proxy access control lists to prevent unauthenticated access.\u003c/li\u003e\n\u003cli\u003eReconfigure the OpenHop deployment to bind to \u003ccode\u003e127.0.0.1\u003c/code\u003e rather than \u003ccode\u003e0.0.0.0\u003c/code\u003e if remote access is not required for the management API.\u003c/li\u003e\n\u003cli\u003eDisable \u003ccode\u003eorigin: true\u003c/code\u003e in the CORS configuration within \u003ccode\u003epackages/server/src/index.ts\u003c/code\u003e and replace it with a restrictive allowlist of trusted origins.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-10T00:50:53Z","date_published":"2026-09-10T00:50:53Z","id":"https://feed.craftedsignal.io/briefs/2026-09-openhop-path-traversal/","summary":"The @openhop/server package is vulnerable to unauthenticated path traversal, allowing remote attackers to read or delete arbitrary YAML files via unsanitized route parameters in the Flow ID endpoint.","title":"Path Traversal Vulnerability in @openhop/server","url":"https://feed.craftedsignal.io/briefs/2026-09-openhop-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - @Openhop/Server (0.3.5)","version":"https://jsonfeed.org/version/1.1"}