← All bulletins

🍯 mariowOS Honeypot (1.2.0)

The mariowOS kernel was lacking authentication across almost its entire API surface and was listening on all network interfaces. This combination meant that a device on the same local network can control system functions on the user's PC without credentials. Multiple endpoints allow command execution; the existing access controls can be bypassed.

What we found

🔴 CRITICAL

C-01 — Command execution via /api/recovery/debug without password

system/server.js:982-998

The route passes req.body.command directly to exec(). The only check is the config.allowFlashing flag; no password is required. Since the flag can be modified by another unprotected route (see C-03) and defaults to true in the distributed config.json, this check offers no real protection.

• Impact: Arbitrary command execution with user privileges.
• Fix: Remove the endpoint, or protect it with the same session token as other sensitive routes and default allowFlashing to false. Unrestricted command execution via HTTP should not exist in a production build.

C-02 — Bypassable guard on /api/remote/exec

system/server.js:2615-2631

The check is if (!match && currentConfig.passwordHash). When passwordHash is null/empty (first boot, after a factory reset, or after /clear-password), the condition evaluates to false and the command is executed without verification.

• Impact: Unauthenticated command execution in all "no password" states.
• Fix: Invert the logic — absence of passwordHash ⇒ 403, never execute. Use constant-time comparison and rate-limiting on attempts. Ideally, gate this behind an authenticated session as well.

C-03 — Privilege escalation via /save-settings

system/server.js:1084-1103

save-settings copies every key not present in the PROTECTED list (passwordHash, verified, quickSettings) into the config. Security flags like allowFlashing, frpLock, rules, and installedApps are not protected and can be set by an unauthenticated request.

• Impact: A caller can independently enable functions that unlock other attack chains (e.g., allowFlashing for C-01).
• Fix: Switch from a denylist to an allowlist: accept only the fields actually modifiable by the user. Everything else must be ignored.

C-04 — Complete config overwrite via /api/system/frp-unlock

system/server.js:957-977

With type:"file", the route executes config = { ...payload, frpLock:false } and overwrites config.json from unauthenticated input: this allows injecting an arbitrary passwordHash and bypassing the FRP lock.

• Impact: Account takeover — the legitimate user can be locked out of their own system.
• Fix: Never rebuild the config from raw input. Accept only a signed/verified recovery file, and do not allow the direct setting of passwordHash.

C-05 — Unauthenticated factory reset and wipe

system/server.js:1136+ (/api/system/factory-reset) and :938 (/api/recovery/wipe)

Both routes delete files and clear the config without any authentication. Aside from direct damage (data loss), they bring the state to "no password," reopening C-02.

• Fix: Require authentication + confirmation; do not clear the passwordHash of a currently active user.

C-06 — Path traversal in sandbox → out-of-bounds write/execution

system/server.js:1434-1470 (/api/sandbox/upload, /api/sandbox/start)

The vmId from the request is concatenated into paths (path.join(sandboxBaseDir, vmId, "disk")) without validation. Then, /api/sandbox/start writes a wrapper and executes node in the resulting directory.

• Impact: Out-of-bounds file write and code execution outside the sandbox.
• Fix: Validate vmId with a strict allowlist (^[a-zA-Z0-9_-]+$), resolve the path, and verify it is contained within sandboxBaseDir (similar to what is done for /home in resolveVirtualPath).

🟠 HIGH

A-01 — Server listens on all interfaces

system/server.js:2887 — app.listen(PORT) lacks a host parameter (though the log prints 127.0.0.1).

• Impact: All the vulnerabilities above are reachable from the LAN, not just localhost.
• Fix: app.listen(PORT, '127.0.0.1'), allowing intentional overrides via a documented environment variable.

A-02 — No session authentication on the API

All /api/* routes except /api/remote/exec lack any verification; /login only returns the desktop HTML and does not establish a session.

• Fix: Issue a signed session token upon login and verify it via a middleware on all mutating routes. hasValidShutdownToken (:147) already exists as a baseline to generalize.

A-03 — Arbitrary host filesystem read via /device

resolveDevicePath :2655 + GET /api/system/files/content

/device exposes the entire host filesystem for reading via HTTP; sensitive user files (keys, configs, saved credentials) can be read by a network caller.

• Fix: Restrict content reading to /home; for /device, retain only directory listing capabilities, or apply a denylist and fs.realpathSync before containment checks (also against symlinks/junctions).

A-04 — Command injection in system helpers

:594/790 (Wi-Fi), :831/886 (Bluetooth), :1837 (extractCmd), :491 (volume)

Request inputs (SSID, MAC, device name, zip path) are interpolated into strings passed to exec().

• Fix: Replace every exec(string) with the spawn(command, args) wrapper already present at :25 (arguments as arrays, no shell); validate inputs with allowlist regexes.

A-05 — Access-Control-Allow-Origin: * on update streams

:2392, :2464 — Any website opened by the user can interact with these streams.

• Fix: Remove the wildcard; allow only the local origin.

A-06 — Rules engine executes arbitrary commands (persistence)

:1729 case 'run': exec(params.command) — Rules are saved via /api/rules/save (:1673) without authentication and triggered by node-cron.

• Impact: A malicious rule will repeatedly execute over time, even after a reboot.
• Fix: Remove the free-text command action; use an allowlist of predefined actions. Protect /api/rules/save.

A-07 — Supply chain: Remote code executed without verification

:1454 git clone of arbitrary URLs, :1296/1318 git pull, OTA/SOTA updates, respawn :2300

Remote code and zip files are downloaded and executed without signature or checksum verification.

• Fix: Implement integrity checks (hash/signature) before execution; restrict sources to trusted repositories.

🟡 MEDIUM

• M-01: Vulnerable nodemailer (SMTP command injection, GHSA-c7w3-x93f-qmm8 / GHSA-vvjj-xcjg-gr5g) in both package.json files. Fix: Update to ≥ 8.0.4.
• M-02: node-cron 3.0.x (vulnerable uuid dependency). Fix: Update to 4.x.
• M-03: body-parser 2.0–2.2.2 (DoS, GHSA-v422-hmwv-36x6). Fix: Update dependency.
• M-04: Multer uploads lack consistent size limits or real content validation on some endpoints (:443, :462, :499, restore :897). Fix: Apply limits.fileSize, validate names with path.basename, verify file signatures.
• M-05: /api/system/restore rebuilds the config from an unauthenticated uploaded file (:906). Fix: Authenticate and validate the schema.
• M-06: eval() used in the frontend terminal desktop/apps/terminal/index.html:1437. Fix: Review this; if processing untrusted input, replace with an explicit parser.

🔵 LOW

• B-01: launcher.js:328 webviewTag:true without will-attach-webview / setWindowOpenHandler event handlers. Fix: Restrict navigation and attachment of child webviews.
• B-02: @tomphttp/bare-server-node is declared but unused. Fix: Remove the dependency.

What we patched

Implemented in this batch (system/server.js unless noted):

• ✅ A-01 — Bound to 127.0.0.1 (override via MARIOWOS_BIND_HOST).
• ✅ C-01 — /api/recovery/debug now requires flag and password; allowFlashing:false in config.json.
• ✅ C-02 — /api/remote/exec fails closed if no password is configured.
• ✅ C-03 — /save-settings converted to an allowlist model.
• ✅ C-04 — File-type frp-unlock can no longer inject an arbitrary passwordHash.
• ✅ C-06 — vmId validated during sandbox upload/start/delete.
• ✅ A-03 — File content reading restricted to /home (no exfiltration from /device).
• ✅ A-04 — Anti-injection validation added to connect-wifi and connect-bt.
• ✅ A-05 — Wildcard CORS removed from update streams.
• ✅ A-06 — run action of the rules engine disabled.
• ✅ M-01/02/03 — nodemailer→10.x, node-cron→4.x, body-parser updated. npm audit = 0 vulnerabilities in both folders.
• ✅ B-03 (partial) — keys.json removed from tracking. Urgent action on the SMTP password in history is still pending (see below).

Implemented — Second Batch:

• ✅ A-02 — Session authentication. Signed cookie (HMAC-SHA256) HttpOnly; SameSite=Strict, issued at login/setup, required on every mutating request (POST/PUT/DELETE/PATCH) except the login/recovery flow. Secret stored in system/session.key (gitignored, never in config.json). Tested end-to-end: unauthenticated POST → 401, valid login → cookie + 200, authenticated call → 200. New endpoint /api/system/logout.
  • Thanks to SameSite=Strict, this also closes the CSRF vector from local web pages targeting 127.0.0.1 on destructive routes: C-05 (factory-reset/wipe) and M-05 (/api/system/restore) are now protected.

New Features:

• ✅ App updates via version.json. install registers repoUrl + version; check-upgrades/do-upgrade compare the local version with the one declared in the app repo's version.json (semver rules, isNewerVersion helper) and only update forward via git pull --ff-only from the set origin. repoUrl is constrained to https github.com URLs (isAllowedRepoUrl) — this also hardens git clone against malicious URLs.
• ✅ Per-app endpoint permissions (transparent foundation). Readable file system/app-permissions.json (prefix→app rules), per-app signed token via POST /api/app/token, enforceAppPermissions middleware. Disabled by default (enforced:false) to avoid breaking apps until the frontend sends X-App-Token. Tested: no token→403, valid token→200, app token on another app's endpoint→403. Honest limitation: Apps are same-origin iframes → least-privilege by convention and traceability, not strong isolation (would require separate per-app origins).

Implemented — Third Batch (User-Side Hardening):

• ✅ A-07 — Update authenticity. OTA (backend self-update) now calls verifyUpdateAuthenticity() before downloading/applying: it verifies a detached signature of version.json against a local public key. Opt-in by key presence: Depositing system/update-pubkey.pem and publishing system/version.json.sig (base64 signature) in the repo makes updates authenticated, and unsigned ones are rejected; without the key, behavior is unchanged with a warning. git clone/git pull of store apps are also constrained to https github.com URLs. The SOTA chain already had integrity verification (hash vs manifest). Note: The signature protects against third-parties/MITM and tampered sources, not against a first-party maintainer signing with the official key.
• ✅ M-04 — Upload limits. Size limits on all uploads (images 8 MB, backup 2 MB, VM zip 512 MB); filenames already fixed or sanitized.
• ✅ M-06 — Terminal eval. math command now uses a safe arithmetic parser (safeMath, shunting-yard); tested to block arbitrary JS.
• ✅ B-01 — Electron webview. launcher.js: web-contents-created with will-attach-webview (denies Node/preload in child webviews) and setWindowOpenHandler (http links → external browser, all else denied).

Implemented — Fourth Batch:

• ✅ Verified boot / Tamper detection. New GET /api/recovery/verify-integrity: compares system/ files with a signed manifest (integrity-manifest.json + .sig, verified against update-pubkey.pem). Reports modified/missing files and, if the system is tampered and is locked (allowFlashing off), returns recommendReflash:true — the intended flow: system touched without unlock → recovery flags it and prompts to reflash clean stock. Real backing for the "VERIFYING FILESYSTEM INTEGRITY" screen, previously a fake loader. Added tool system/tools/gen-integrity-manifest.js to generate the manifest on release. Tested: intact build → tampered:false; altered file → tampered:true + recommendReflash:true.
• ✅ Authenticated flashing unlock (OEM-unlock analog). New POST /api/recovery/set-flashing requiring mandatory account password: the only way to enable allowFlashing, now that C-03 removed the remote path. Thus, "unlock" is a deliberate act by the local user, not a flag secretly flipped by whoever delivers the build. Tested: no session → 401, wrong password → 403, correct → unlocks with explicit warning.
• ↪️ "Reflash clean stock" reuses the already signed OTA (A-07): download+apply verified stock, no unsigned code installer added.