Crabbox vulnerabilities

A vulnerability in Crabbox prior to v0.12.0 allows environment variable exposure, leaking sensitive data like API tokens, cloud credentials, and broker tokens into remote command environments. Attackers with access to a malicious or compromised repository can exploit overly permissive environment variable allowlisting in repo-local Crabbox configuration.

A privilege escalation vulnerability in Crabbox prior to v0.12.0 allows users with visibility-only access to obtain Code, WebVNC, and Egress agent tickets via POST requests. Attackers can exploit insufficient access controls on ticket endpoints to impersonate trusted lease-side bridges.

An authentication bypass vulnerability in Crabbox prior to v0.12.0 allows non-admin shared-token callers to impersonate other owners or organizations by spoofing identity headers.

Crabbox before version 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution. Attackers can supply absolute or relative paths that resolve outside the intended /workspace directory.

Crabbox before version 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path. The verifyUserToken() function fails to reject payloads containing an admin claim, allowing attackers to escalate privileges.