Unauthenticated Admin API Vulnerability in @Mockoon/commons-server

Executive Intelligence Brief

A critical vulnerability has been discovered in @Mockoon/commons-server, which allows unauthenticated attackers to hijack mock-state, steal sensitive information, and poison environment variables. This vulnerability, tracked as CVE-2026-59148, is caused by the lack of authentication and a wildcard CORS configuration in the admin API. The affected deployments include commons-server, CLI, and serverless, with a wide range of potential impacts, from secret theft to runtime mock route rewriting. The vulnerability has a CVSS score of 8.8 in local-dev mode and 9.4 in network-exposed deployments, indicating a high to critical severity level. The attack vector involves an unauthenticated attacker who can reach the mock server's port, allowing for various malicious activities, including reading and writing environment variables, rewriting mock routes, and harvesting authentication tokens.

Threat Overview

The @Mockoon/commons-server package is a part of Mockoon, a popular API mocking tool used for local development and testing. The admin API, enabled by default in all shipped runtimes, lacks authentication and has a permissive CORS configuration, allowing unauthenticated attackers to perform various malicious actions. The vulnerability has significant implications for the broader security landscape, as it can be exploited in both local-dev and network-exposed deployments. In local-dev mode, an attacker can exploit the vulnerability by visiting a malicious website while running the Mockoon CLI. In network-exposed deployments, the vulnerability can be exploited without user interaction.

Technical Deep Dive

Vulnerability Classification

The vulnerability can be classified as CWE-306: Missing Authentication for Critical Function. This class of vulnerability occurs when an application does not implement authentication for critical functions, allowing unauthorized access. The CVSS vector details are: - CVSS Score: 8.8 (local-dev mode) and 9.4 (network-exposed deployment) - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L (local-dev mode)

Root Cause Analysis

The root cause of the vulnerability lies in the default configuration of the admin API in @Mockoon/commons-server. Specifically: - The admin API is enabled by default in all shipped runtimes. - The admin API lacks authentication, with no token, shared secret, or environment variable checks. - The admin API has a permissive CORS configuration, allowing all HTTP methods and headers.

Attack Vector & Chain

The attack vector involves an unauthenticated attacker who can reach the mock server's port. The attacker can perform various malicious activities, including: - Reading every `MOCKOON_*` environment variable used by the operator as secret material in templates. - Writing arbitrary process environment variables, poisoning operator secrets or process-level variables. - Rewriting every mock route's body, status, and headers in-runtime, allowing downstream consumers to ingest attacker-controlled responses and headers. - Harvesting authentication tokens via transaction logs and SSE streams. - Purging state, data buckets, and logs.

Exploitation Scenario Walkthrough

**Scenario: Mock-State Hijack and Secret Theft via Unauthenticated Admin API** 1. Reconnaissance: An attacker discovers a vulnerable Mockoon deployment, either locally or in a network-exposed environment. 2. Weaponization: The attacker prepares a series of requests to exploit the unauthenticated admin API, including reading environment variables, rewriting mock routes, and harvesting authentication tokens. 3. Delivery & Exploitation: The attacker sends requests to the vulnerable admin API, exploiting the lack of authentication and permissive CORS configuration. 4. Post-Exploitation: The attacker uses the gained access to poison environment variables, rewrite mock routes, and harvest authentication tokens. 5. Impact Realization: The attacker achieves various malicious goals, including secret theft, runtime mock route rewriting, and authentication token harvesting.

Impact Analysis

Direct Impact

The vulnerability allows an attacker to: - Read every `MOCKOON_*` environment variable. - Write arbitrary process environment variables. - Rewrite every mock route's body, status, and headers in-runtime. - Harvest authentication tokens via transaction logs and SSE streams. - Purge state, data buckets, and logs.

Downstream & Cascading Effects

The vulnerability has significant downstream and cascading effects, including: - Supply chain risk: The vulnerability can be exploited in CI/CD pipelines, allowing attackers to poison dependencies and compromise downstream applications. - Regulatory implications: The vulnerability can lead to sensitive information disclosure, violating regulatory requirements. - Customer data exposure: The vulnerability can result in unauthorized access to sensitive customer data.

Detection & Threat Hunting

Indicators of Compromise

The following indicators of compromise can be used to detect potential exploitation: - Unusual environment variable changes. - Unexpected mock route rewrites. - Suspicious transaction log activity.

Detection Rules & Signatures

The following detection rules and signatures can be used to identify potential exploitation: - Monitor admin API requests for unusual activity. - Detect changes to environment variables and mock routes. - Identify suspicious transaction log activity.

Remediation & Hardening

Immediate Actions (0-24 hours)

The following immediate actions can be taken to mitigate the vulnerability: - Patch to the latest version of @Mockoon/commons-server. - Disable the admin API if not required. - Implement authentication for the admin API.

Short-Term Hardening (1-7 days)

The following short-term hardening measures can be implemented: - Implement network segmentation to restrict access to the mock server. - Configure a Web Application Firewall (WAF) to detect and prevent suspicious activity. - Enhance monitoring and logging to detect potential exploitation.

Strategic Recommendations

The following strategic recommendations can be implemented to prevent similar vulnerabilities: - Implement secure authentication and authorization for critical functions. - Conduct regular security audits and penetration testing. - Enhance secure coding practices and code reviews.