The embedded HTTP/WebSocket server in src/web/server/server.ts calls Bun.serve() without specifying a hostname, defaulting to 0.0.0.0.
This exposes the API to all network interfaces, allowing for remote code execution by just nmap discovery, an attacker who can reach the host can:
- List and read PTY session output (
GET /api/sessions, GET /api/sessions/:id/buffer/*)
- Send arbitrary input to running PTY sessions (
POST /api/sessions/:id/input)
- Kill sessions (
DELETE /api/sessions/:id)
- Spawn new processes via the API (
POST /api/sessions)
Fix: Bind to 127.0.0.1 by default with configurable hostname support, can suggest a PR if needed, but this is a critical security issue that should be addressed ASAP.
The embedded HTTP/WebSocket server in
src/web/server/server.tscallsBun.serve()without specifying ahostname, defaulting to0.0.0.0.This exposes the API to all network interfaces, allowing for remote code execution by just nmap discovery, an attacker who can reach the host can:
GET /api/sessions,GET /api/sessions/:id/buffer/*)POST /api/sessions/:id/input)DELETE /api/sessions/:id)POST /api/sessions)Fix: Bind to
127.0.0.1by default with configurable hostname support, can suggest a PR if needed, but this is a critical security issue that should be addressed ASAP.