{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/logto/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-63188"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@logto/tunnel"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Logto"],"content_html":"\u003cp\u003eThe \u003ccode\u003e@logto/tunnel\u003c/code\u003e CLI tool, commonly used for testing Logto sign-in experiences, contains a high-severity path traversal vulnerability tracked as CVE-2026-63188. The vulnerability resides in the static asset proxy implementation within \u003ccode\u003epackages/tunnel/src/commands/tunnel/utils.ts\u003c/code\u003e. When the tunnel is started with the \u003ccode\u003e--experience-path\u003c/code\u003e flag, the application serves files from this directory using a proxy that fails to validate or normalize incoming request URLs.\u003c/p\u003e\n\u003cp\u003eBy crafting a request containing directory traversal sequences (e.g., \u003ccode\u003e../\u003c/code\u003e), an unauthenticated network actor can escape the intended static file root. Because the server uses \u003ccode\u003epath.join\u003c/code\u003e to resolve the final filesystem path without subsequent containment checks, it directly accesses any file readable by the user process running the tunnel. This is particularly critical when the tunnel is exposed to network interfaces, allowing attackers to exfiltrate local configuration, development environment secrets, or sensitive files from the host machine.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe target deploys a Logto tunnel service using the \u003ccode\u003elogto-tunnel\u003c/code\u003e CLI and specifies a custom UI directory via the \u003ccode\u003e--experience-path\u003c/code\u003e option.\u003c/li\u003e\n\u003cli\u003eThe service binds to a network port (e.g., 9000) on all interfaces, exposing the static proxy functionality.\u003c/li\u003e\n\u003cli\u003eAn attacker identifies the accessible tunnel port via network scanning or local internal reconnaissance.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts an HTTP request to the tunnel port with a path containing traversal sequences, such as \u003ccode\u003eGET /../../etc/passwd HTTP/1.1\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003epackages/tunnel/src/commands/tunnel/utils.ts\u003c/code\u003e module receives the request and appends the malicious URL directly to the base \u003ccode\u003estaticPath\u003c/code\u003e using \u003ccode\u003epath.join\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application performs an \u003ccode\u003efs.open\u003c/code\u003e call on the resulting path, successfully resolving to a file outside the designated root.\u003c/li\u003e\n\u003cli\u003eThe tunnel service returns the contents of the requested file in the HTTP response body to the attacker.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to read arbitrary files from the filesystem of the host running \u003ccode\u003elogto-tunnel\u003c/code\u003e. In development environments where this tool is typically deployed, this can lead to the exfiltration of credentials, API keys, and sensitive project configuration files.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003e@logto/tunnel\u003c/code\u003e to a version containing the patch for CVE-2026-63188.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the tunnel service by binding only to \u003ccode\u003elocalhost\u003c/code\u003e (127.0.0.1) if remote access is not required for testing.\u003c/li\u003e\n\u003cli\u003eEnable web server logs to monitor for requests containing path traversal sequences (\u003ccode\u003e../\u003c/code\u003e) targeting the tunnel port.\u003c/li\u003e\n\u003cli\u003eUse network access control lists (ACLs) to block external or unauthorized internal connections to the configured tunnel port.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-19T22:33:21Z","date_published":"2026-08-19T22:33:21Z","id":"https://feed.craftedsignal.io/briefs/2026-08-logto-tunnel-traversal/","summary":"The @logto/tunnel package (v0.3.8 and earlier) is vulnerable to a path traversal attack allowing unauthenticated, remote read access to local files via improper URL sanitization.","title":"Path Traversal in @logto/tunnel Service","url":"https://feed.craftedsignal.io/briefs/2026-08-logto-tunnel-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Logto","version":"https://jsonfeed.org/version/1.1"}