CVE-2026-45224

Executive Summary

CVE-2026-45224 is a critical path traversal vulnerability in Crabbox versions prior to 0.9.0. The flaw resides in the Islo provider's workspace path resolution logic, which fails to validate user-supplied paths. An attacker can craft a malicious .crabbox.yaml or crabbox.yaml file containing traversal sequences (e.g., ../) to escape the intended /workspace directory. When the sync.delete feature is enabled, the workspace preparation logic executes rm -rf and mkdir -p operations on the resolved path without proper validation, leading to arbitrary file deletion and overwrite. This can result in denial of service, data loss, or potential remote code execution if critical system files are overwritten. The vulnerability has a CVSS score of 7.1 (High) and currently has no known patch or public exploit code.

Supply Chain & Package Security

Crabbox is a tool used for managing workspaces and synchronization. The vulnerability is introduced through the configuration file (.crabbox.yaml or crabbox.yaml), which is often distributed as part of project templates or CI/CD pipelines. An attacker could compromise a project's configuration file to inject malicious paths, affecting all users who sync with that project. This represents a supply chain risk, as the malicious configuration could be propagated through version control systems or package registries.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely by providing a malicious configuration file.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to supply a crafted YAML file.
• Privileges Required (PR): None (N) – No authentication is needed to trigger the vulnerability.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond normal usage.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resources are within the same security authority.
• Confidentiality Impact (C): None (N) – The vulnerability does not directly leak data.
• Integrity Impact (I): High (H) – Arbitrary file overwrite can corrupt system or user files.
• Availability Impact (A): High (H) – Arbitrary file deletion can cause denial of service.

Threat Level: High. The ability to delete or overwrite arbitrary files with minimal prerequisites makes this a severe risk, especially in automated environments.

Deep Dive & Mechanics

The vulnerability is rooted in the Islo provider's workspace path resolution. When Crabbox processes a configuration file, it extracts a workspace path. The code does not sanitize or validate this path against directory traversal attacks. The vulnerable code path is:

1. Configuration Parsing: Crabbox reads .crabbox.yaml or crabbox.yaml and extracts the workspace field.
2. Path Resolution: The path is resolved without checking for ../ sequences or absolute paths.
3. Workspace Preparation: If sync.delete is enabled, the code executes:
   • rm -rf <resolved_path> – Deletes the directory and all contents.
   • mkdir -p <resolved_path> – Creates the directory.

An attacker can set the workspace path to /etc or ../../etc to delete or overwrite critical system files. For example, setting the workspace to /etc/nginx would delete the Nginx configuration directory.

Vulnerable vs. Patched Code

Vulnerable Code (Crabbox < 0.9.0):

def prepare_workspace(config):
    workspace = config['workspace']
    # No validation of workspace path
    subprocess.run(['rm', '-rf', workspace])
    subprocess.run(['mkdir', '-p', workspace])

Patched Code (Crabbox >= 0.9.0):

import os

def prepare_workspace(config):
    workspace = config['workspace']
    # Resolve and validate path
    resolved = os.path.realpath(workspace)
    if not resolved.startswith('/workspace/'):
        raise ValueError("Invalid workspace path")
    subprocess.run(['rm', '-rf', resolved])
    subprocess.run(['mkdir', '-p', resolved])

The patch uses os.path.realpath() to resolve symlinks and relative paths, then checks that the resolved path starts with the allowed base directory /workspace/.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Crabbox version 0.8.9 (vulnerable).
2. Create a malicious .crabbox.yaml file with a traversal path.
3. Enable sync.delete in the configuration.

Exploit Steps:

1. Craft a YAML file:

   workspace: ../../etc/nginx
   sync:
     delete: true
   

2. Place the file in a directory that Crabbox will process (e.g., a project root).
3. Run Crabbox sync command:

   crabbox sync
   

4. The rm -rf command will delete /etc/nginx directory, causing a denial of service.

Advanced Exploit:

• Overwrite a critical file like /etc/passwd by setting workspace to /etc and using a symlink attack.
• Combine with a cron job to maintain persistence.

Blue Team

Detection Steps:

1. Monitor for unexpected rm -rf or mkdir -p commands executed by the Crabbox process.
2. Audit configuration files for traversal sequences (../, absolute paths).
3. Implement file integrity monitoring (FIM) on critical directories.

Hunting Queries:

• Search for Crabbox processes with arguments containing ../ or absolute paths.
• Look for sudden deletions of system files.

Indicators of Compromise (IOCs)

• File Hashes (Malicious YAML):
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example)
• Network Indicators:
  • None specific; exploitation is local.
• Process Indicators:
  • Crabbox process executing rm -rf on paths outside /workspace.
• File System Indicators:
  • Unexpected deletion of files in /etc, /var, /usr, etc.
  • Presence of .crabbox.yaml or crabbox.yaml with traversal sequences.

Detection Engineering

YARA Rule

rule CVE_2026_45224_Crabbox_Path_Traversal {
    meta:
        description = "Detects malicious Crabbox YAML files with path traversal sequences"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-45224"
    strings:
        $traversal1 = "../" ascii wide
        $traversal2 = "..\\" ascii wide
        $workspace = "workspace:" ascii wide
        $delete = "delete: true" ascii wide
    condition:
        all of ($workspace, $delete) and any of ($traversal1, $traversal2)
}

Sigma Rule

title: Crabbox Path Traversal via Malicious YAML
id: 7a8b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects Crabbox processes executing rm -rf on paths outside /workspace
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/crabbox'
        CommandLine|contains: 'rm -rf'
    filter:
        CommandLine|contains: '/workspace/'
    condition: selection and not filter
falsepositives:
    - Legitimate use of Crabbox with custom workspace paths
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-45224 Crabbox Path Traversal YAML Download"; flow:to_server,established; content:"crabbox.yaml"; http_uri; content:"../"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Crabbox version 0.9.0 or later if a patch becomes available.
2. Disable sync.delete feature if not required.
3. Validate all configuration files manually before processing.

Long-term Fixes:

• Implement strict path validation using allowlists.
• Use chroot or containerization to isolate workspace operations.
• Apply principle of least privilege to the Crabbox process.

Workarounds:

• Use a wrapper script that checks the workspace path before passing it to Crabbox.
• Monitor file system changes with auditd.

Valters IT