Understanding and Defending Against Path Traversal in logto-tunnel

Overview

The logto-tunnel package, specifically version <= 0.3.8, is vulnerable to a path traversal attack. This vulnerability, tracked as CVE-2026-63188 with a CVSS score of 8.7, allows an unauthenticated attacker to read files outside the configured custom UI static directory by manipulating the URL with `../` path segments. The vulnerability resides in how the package handles file requests when the `--experience-path` option is used.

Understanding the Vulnerability / Threat

Root Cause Analysis

The root cause of this vulnerability is the improper limitation of a pathname to a restricted directory, also known as path traversal (CWE-22). The issue arises from how the `logto-tunnel` command handles the `--experience-path` option and serves static files. When the `--experience-path` option is set, the `createStaticFileProxy(path)` function is enabled. This function sends non-Logto, non-`--experience-uri` requests to a static proxy. The server is started with `server.listen(port)`, making it reachable on all interfaces. In `packages/tunnel/src/commands/tunnel/utils.ts`, the filesystem path is built using `path.join(staticPath, fallBackToIndex ? index : request.url)`. Here, `request.url` is used directly without any URL normalization or containment checks. This allows an attacker to use `../` path segments in a static asset request to read files outside the configured static directory.

Attack Surface & Vector

The attack surface for this vulnerability is the tunnel service started by the `logto-tunnel` command. An attacker can reach this service if the tunnel port is exposed and reachable from another host. The vector of attack involves crafting a request URL with `../` path segments to exploit the path traversal vulnerability.

Exploitation Mechanics — Scenario Walkthrough

Scenario: Compromising a Corporate Jenkins Instance through Path Traversal 1. Initial Position: An attacker gains access to a corporate network and discovers that a developer is using `logto-tunnel` with the `--experience-path` option set to `/tmp/logto-ui/static`. 2. Triggering the Flaw: The attacker crafts a request URL such as `http://:9000/../secret.txt` to exploit the path traversal vulnerability. 3. What Breaks: The `logto-tunnel` service, without proper containment checks, resolves the request URL to `/tmp/logto-ui/secret.txt` and returns its contents. 4. Attacker's Prize: The attacker gains access to sensitive files readable by the `logto-tunnel` process, such as development secrets or credentials stored near the custom UI project.

Real-World Impact

The impact of this vulnerability is arbitrary file read outside the configured custom UI static directory. If the tunnel port is reachable from another host, an unauthenticated network peer can read local files readable by the `logto-tunnel` process. This could lead to the exposure of sensitive information, such as development secrets or credentials.

Detection & Defense

Immediate Mitigations

- Upgrade `@logto/tunnel` to version 0.3.9 or later. - Ensure that the tunnel port is not exposed to untrusted networks. - Use network access controls to limit the reachability of the tunnel service.

Detection Strategies

- Monitor for unusual file access patterns or requests with `../` path segments. - Implement security monitoring to detect and alert on potential path traversal attempts. - Use SIEM rules to identify and investigate suspicious activities.

Long-Term Hardening

- Implement proper URL normalization and containment checks for file paths. - Enforce strict access controls and authentication for services like `logto-tunnel`. - Regularly update and patch dependencies to prevent known vulnerabilities.

Key Takeaways

- Path traversal vulnerabilities can lead to sensitive file exposure. - Proper URL normalization and containment checks are crucial for preventing path traversal attacks. - Regular updates and patches are essential for maintaining the security of dependencies. - Network access controls and monitoring can help detect and mitigate attacks.

Sources

- GitHub Security Advisories: https://github.com/advisories/GHSA-rxjr-6c9q-h67x - CVE-2026-63188