Security vulnerabilities

Subject: High Severity —  FS#390  Incomplete Fix: Runtime-Control Environment Variable Injection via Site API

Hello alwaysdata Security Team,

I am reporting a High Severity incomplete-fix vulnerability related to  FS#390 , concerning runtime-control environment variable injection through the Site API.

### Researcher

Hacker AK Security Researcher
Email: [hackerak822@gmail.com](mailto:hackerak822@gmail.com)

### Severity

High — CVSS 3.1: 8.8

```text
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
```

### Summary

The previously reported  FS#390  vulnerability allowed customer-controlled environment variables to influence application process startup through the alwaysdata Site API.

The original issue involved the `LD_PRELOAD` environment variable. Although the original vulnerability was fixed, the broader security boundary around runtime-control environment variables should also prevent equivalent startup mechanisms.

The affected functionality is:

```http
PATCH /v1/site/{SITE_ID}/
```

through the:

```json
{"environment":"<VARIABLE>=<VALUE>"}
```

field.

Runtime-control variables such as `NODE_OPTIONS`, `PYTHONSTARTUP`, `RUBYOPT`, `PERL5OPT`, and `BASH_ENV` can influence interpreter startup and may provide an attacker-controlled code-execution primitive.

### Original  FS#390  Context

The original vulnerability involved:

```text
LD_PRELOAD=/tmp/evil.so
```

through the `environment` field.

The original  FS#390  issue was fixed on July 13, 2026.

### Primary Proof of Concept

The primary validation payload is:

```text
NODE_OPTIONS=–version
```

Request:

```bash
curl -s -o /tmp/out.json -w "HTTP:%{http_code}\n" \

1. X PATCH "https://api.alwaysdata.com/v1/site/$SITE_ID/" \
2. -basic –user "$APIKEY:" \
3. H "Content-Type: application/json" \
4. d '{"environment":"NODE_OPTIONS=–version"}'

```

The purpose of this PoC is to verify whether the Site API security control covers runtime-control environment variables beyond the originally reported `LD_PRELOAD`.

### Security Impact

If a runtime-control variable is accepted and persisted, it can influence application startup.

For example:

```text
NODE_OPTIONS=–require /path/to/module.js
```

can cause Node.js to load a module automatically during startup.

Potential impact includes:

* Arbitrary code execution as the site user
* Access to application environment variables
* Exposure of API keys and database credentials
* Modification of application files
* Application-level persistence
* Runtime manipulation

### Recommended Remediation

The preferred remediation is to use a strict allowlist for customer-controlled environment variables rather than maintaining an expanding denylist.

Recommended controls:

1. Allow only explicitly permitted environment-variable names.
2. Normalize variable names before validation.
3. Reject leading/trailing whitespace and malformed definitions.
4. Validate both variable names and values.
5. Apply validation consistently across all Site API management paths.
6. Ensure application processes receive only explicitly permitted environment variables.

### Regression Tests

The following runtime-control variables should be covered by the security validation:

```text
LD_PRELOAD=canary
LD_LIBRARY_PATH=canary

NODE_OPTIONS=–version
NODE_PATH=canary

PYTHONSTARTUP=canary
PYTHONPATH=canary
PYTHONHOME=canary
PYTHONINSPECT=1

RUBYOPT=canary
RUBYLIB=canary

PERL5OPT=canary
PERL5LIB=canary

BASH_ENV=canary
ENV=canary

JAVA_TOOL_OPTIONS=canary
_JAVA_OPTIONS=canary
```

Normalization variants should also be tested:

```text
ld_preload=canary
Ld_Preload=canary
LD_PRELOAD =canary
```

### Impact

An authenticated attacker with the required Site API permissions could potentially use a permitted runtime-control environment variable to influence the startup behavior of their hosted application.

If code execution is confirmed, the attacker could potentially:

* Execute arbitrary code as the site user
* Read application secrets
* Access environment credentials
* Modify application files
* Establish persistence
* Affect application availability and integrity

Severity: High — CVSS 3.1: 8.8

### Requested Action

Please verify that the  FS#390  remediation protects against the complete class of runtime-control environment variable injection, rather than only the originally reported `LD_PRELOAD` value.

The security requirement should be:

Customer-controlled environment variables must not be capable of modifying interpreter, loader, shell, or JVM startup behavior.

Thank you for reviewing this security report.

Regards,

Hacker AK Security Researcher
[hackerak822@gmail.com](mailto:hackerak822@gmail.com)

Testing Date: 2026-08-16