BUG_Author: Zy0t1
Affected Version: Abstruse CI all historical versions + master branch (no formal version tags released)
Vendor: bleenco/abstruse
Software: Abstruse CI
Vulnerability Files: - server/api/worker/download_cache.go
CWE: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) - The software uses external input to construct a pathname that is intended to identify a file or directory located beneath a restricted parent directory, but it does not properly neutralize special elements such as ../ sequences that can resolve to a location that is outside of that directory.
CVSS 3.1: 7.5 (High) - AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
This report describes two distinct vulnerabilities in Abstruse CI that, when combined, form a complete attack chain for arbitrary file read.
Vulnerability A: Path Traversal in Worker /cache Endpoint (CWE-22)
In server/api/worker/download_cache.go (line 25), the file query parameter is used directly in filepath.Join(config.DataDir, "cache", r.URL.Query().Get("file")) without any sanitization. There is no .. detection, no canonical path checking, and no base directory confinement. The resulting path is passed to os.Open() and file contents are streamed back to the attacker via io.Copy(w, file).
Go’s filepath.Join calls filepath.Clean, which resolves .. at the path component level but cannot prevent relative path traversal. When the server’s working directory is / (default Docker deployment), filepath.Join("data/", "cache", "../../../../../../etc/passwd") resolves to ../../etc/passwd, which os.Open interprets relative to cwd /, ultimately resolving to /etc/passwd.
This endpoint requires Worker JWT authentication (WorkerAuthenticator middleware). An attacker who already possesses a valid Worker JWT can exploit this vulnerability to read arbitrary files on the server filesystem.
Vulnerability B: Hardcoded JWT Signing Secret (CWE-798)
The JWT signing secret (JWTSecret) is hardcoded in the server configuration file /abstruse/abstruse-server.json with the value fa27ef3ef6570e32a79e74deca7c1bc3. This value is also injected as the environment variable ABSTRUSE_AUTH_JWTSECRET. The secret is identical across all deployments using the default configuration and can be discovered by any source code review or configuration inspection tool.
An attacker who obtains this secret can forge an arbitrary Worker JWT using HS256 with id and addr claims, bypassing authentication entirely.
Combined Attack Chain
Individually, each vulnerability has limited impact: