|
Task Description
Subject: High Severity — FS#390 Incomplete Fix: Runtime-Control Environment Variable Injection via Site API
Hello alwaysdata Security Team,
I am reporting a High Severity incomplete-fix vulnerability related to FS#390 , concerning runtime-control environment variable injection through the Site API.
### Researcher
Hacker AK Security Researcher
Email: [hackerak822@gmail.com](mailto:hackerak822@gmail.com)
### Severity
High — CVSS 3.1: 8.8
```text
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
```
### Summary
The previously reported FS#390 vulnerability allowed customer-controlled environment variables to influence application process startup through the alwaysdata Site API.
The original issue involved the `LD_PRELOAD` environment variable. Although the original vulnerability was fixed, the broader security boundary around runtime-control environment variables should also prevent equivalent startup mechanisms.
The affected functionality is:
```http
PATCH /v1/site/{SITE_ID}/
```
through the:
```json
{"environment":"<VARIABLE>=<VALUE>"}
```
field.
Runtime-control variables such as `NODE_OPTIONS`, `PYTHONSTARTUP`, `RUBYOPT`, `PERL5OPT`, and `BASH_ENV` can influence interpreter startup and may provide an attacker-controlled code-execution primitive.
### Original FS#390 Context
The original vulnerability involved:
```text
LD_PRELOAD=/tmp/evil.so
```
through the `environment` field.
The original FS#390 issue was fixed on July 13, 2026.
### Primary Proof of Concept
The primary validation payload is:
```text
NODE_OPTIONS=–version
```
Request:
```bash
curl -s -o /tmp/out.json -w "HTTP:%{http_code}\n" \
-
-basic –user "$APIKEY:" \
H "Content-Type: application/json" \
d '{"environment":"NODE_OPTIONS=–version"}'
```
The purpose of this PoC is to verify whether the Site API security control covers runtime-control environment variables beyond the originally reported `LD_PRELOAD`.
### Security Impact
If a runtime-control variable is accepted and persisted, it can influence application startup.
For example:
```text
NODE_OPTIONS=–require /path/to/module.js
```
can cause Node.js to load a module automatically during startup.
Potential impact includes:
* Arbitrary code execution as the site user
* Access to application environment variables
* Exposure of API keys and database credentials
* Modification of application files
* Application-level persistence
* Runtime manipulation
### Recommended Remediation
The preferred remediation is to use a strict allowlist for customer-controlled environment variables rather than maintaining an expanding denylist.
Recommended controls:
1. Allow only explicitly permitted environment-variable names.
2. Normalize variable names before validation.
3. Reject leading/trailing whitespace and malformed definitions.
4. Validate both variable names and values.
5. Apply validation consistently across all Site API management paths.
6. Ensure application processes receive only explicitly permitted environment variables.
### Regression Tests
The following runtime-control variables should be covered by the security validation:
```text
LD_PRELOAD=canary
LD_LIBRARY_PATH=canary
NODE_OPTIONS=–version
NODE_PATH=canary
PYTHONSTARTUP=canary
PYTHONPATH=canary
PYTHONHOME=canary
PYTHONINSPECT=1
RUBYOPT=canary
RUBYLIB=canary
PERL5OPT=canary
PERL5LIB=canary
BASH_ENV=canary
ENV=canary
JAVA_TOOL_OPTIONS=canary
_JAVA_OPTIONS=canary
```
Normalization variants should also be tested:
```text
ld_preload=canary
Ld_Preload=canary
LD_PRELOAD =canary
```
### Impact
An authenticated attacker with the required Site API permissions could potentially use a permitted runtime-control environment variable to influence the startup behavior of their hosted application.
If code execution is confirmed, the attacker could potentially:
* Execute arbitrary code as the site user
* Read application secrets
* Access environment credentials
* Modify application files
* Establish persistence
* Affect application availability and integrity
Severity: High — CVSS 3.1: 8.8
### Requested Action
Please verify that the FS#390 remediation protects against the complete class of runtime-control environment variable injection, rather than only the originally reported `LD_PRELOAD` value.
The security requirement should be:
Customer-controlled environment variables must not be capable of modifying interpreter, loader, shell, or JVM startup behavior.
Thank you for reviewing this security report.
Regards,
Hacker AK Security Researcher
[hackerak822@gmail.com](mailto:hackerak822@gmail.com)
Testing Date: 2026-08-16
|
