CSRF in @rsdoctor/sdk Allows Arbitrary Command Execution via the __open-in-editor Endpoint
Package
| Package |
Affected versions |
Patched version |
@rsdoctor/sdk |
<= 1.5.17 |
1.5.18 |
This issue also affects downstream users of @rsdoctor/rspack-plugin, @rsdoctor/webpack-plugin, and @rsdoctor/cli. Upgrade these packages to 1.5.18 or later.
Severity
High — CVSS 3.1: 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
- CWE-352: Cross-Site Request Forgery
- CWE-78: Improper Neutralization of Special Elements used in an OS Command
Description
Summary
The Rsdoctor SDK report server exposes the GET /__open-in-editor endpoint without authentication or CSRF protection.
The endpoint accepts attacker-controlled file and editor query parameters and passes them to the launch-editor package.
A malicious webpage visited by a developer with a running Rsdoctor report server can issue a cross-origin request that executes an attacker-controlled command with the privileges of the local Rsdoctor process.
This vulnerability affects @rsdoctor/sdk versions 1.5.17 and earlier and is fixed in version 1.5.18.
Details
The vulnerable endpoint is implemented in:
packages/sdk/src/sdk/server/index.ts
Before the fix:
- The endpoint accepted unauthenticated
GET and HEAD requests.
- No CSRF token or equivalent request authentication was required.
- The
editor parameter was passed directly to launch-editor.
- An attacker could supply shell command arguments such as
sh -c id.
POC
The following proof of concept applies to Linux and macOS environments and uses the harmless id command to verify command execution.
-
Start Rsdoctor with an affected version, such as @rsdoctor/rspack-plugin@1.5.17, and identify the report server port as <PORT>.
-
Create a malicious webpage:
<!doctype html>
<html>
<body>
<img
src="http://127.0.0.1:<PORT>/__open-in-editor?file=%2Fetc%2Fhosts&editor=sh%20-c%20id"
/>
</body>
</html>
-
Open the webpage in a browser.
-
In the affected version, the request does not require a token. The server passes editor=sh -c id to launch-editor, causing the id command to execute with the privileges of the local Rsdoctor process.
-
In the fixed 1.5.18 version, the same request is rejected with 403 Forbidden because it does not contain a valid socket token, and the command is not executed.
The PoC uses id only to print the current user identity. It does not modify or delete local files.
Impact
Successful exploitation may allow a remote attacker to execute arbitrary commands with the privileges of the local Rsdoctor process. This can result in source-code disclosure, modification or deletion of local files, credential theft, or further compromise of the developer machine.
Remediation
Upgrade to:
The fix from PR #1817:
- Requires the server socket token for
__open-in-editor requests.
- Compares tokens using a timing-safe comparison.
- Restricts allowed
editor values to code, cursor, and trae.
- Updates the client to include the socket token in requests.
- Adds regression tests for missing tokens and unsupported editors.
No CVE has been assigned.
xiaohai12138-1 Reporter
CSRF in
@rsdoctor/sdkAllows Arbitrary Command Execution via the__open-in-editorEndpointPackage
@rsdoctor/sdk<= 1.5.171.5.18This issue also affects downstream users of
@rsdoctor/rspack-plugin,@rsdoctor/webpack-plugin, and@rsdoctor/cli. Upgrade these packages to1.5.18or later.Severity
High — CVSS 3.1: 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HWeaknesses
Description
Summary
The Rsdoctor SDK report server exposes the
GET /__open-in-editorendpoint without authentication or CSRF protection.The endpoint accepts attacker-controlled
fileandeditorquery parameters and passes them to thelaunch-editorpackage.A malicious webpage visited by a developer with a running Rsdoctor report server can issue a cross-origin request that executes an attacker-controlled command with the privileges of the local Rsdoctor process.
This vulnerability affects
@rsdoctor/sdkversions1.5.17and earlier and is fixed in version1.5.18.Details
The vulnerable endpoint is implemented in:
Before the fix:
GETandHEADrequests.editorparameter was passed directly tolaunch-editor.sh -c id.POC
The following proof of concept applies to Linux and macOS environments and uses the harmless
idcommand to verify command execution.Start Rsdoctor with an affected version, such as
@rsdoctor/rspack-plugin@1.5.17, and identify the report server port as<PORT>.Create a malicious webpage:
Open the webpage in a browser.
In the affected version, the request does not require a token. The server passes
editor=sh -c idtolaunch-editor, causing theidcommand to execute with the privileges of the local Rsdoctor process.In the fixed
1.5.18version, the same request is rejected with403 Forbiddenbecause it does not contain a valid socket token, and the command is not executed.The PoC uses
idonly to print the current user identity. It does not modify or delete local files.Impact
Successful exploitation may allow a remote attacker to execute arbitrary commands with the privileges of the local Rsdoctor process. This can result in source-code disclosure, modification or deletion of local files, credential theft, or further compromise of the developer machine.
Remediation
Upgrade to:
The fix from PR #1817:
__open-in-editorrequests.editorvalues tocode,cursor, andtrae.No CVE has been assigned.