Directory Traversal in Northern.tech Mender Server

The repository is minimal and centered on a single Nuclei template, CVE-2026-49009.yaml, plus a LICENSE and a long-form README. The exploit targets Northern.tech Mender Server and Mender Server Enterprise versions described as vulnerable to CVE-2026-49009, an authenticated path traversal in the single-file artifact generation API that can be turned into remote code execution. Because this is a Nuclei repository artifact, the main exploit logic is entirely in the YAML template. The template performs a two-step authenticated attack chain: first it sends a POST request to /api/management/v1/useradm/auth/login using Basic authentication to obtain a JWT from the response body; then it sends a multipart POST to /api/management/v1/deployments/artifacts/generate with type=single-file and a crafted JSON args field containing filename ../../../../usr/bin/mender-artifact and dest_dir /opt/mender/app. The uploaded file is a shell script payload that replaces the expected executable path. When the asynchronous create-artifact-worker later invokes /usr/bin/mender-artifact, the attacker-controlled script runs. The included payload is operational rather than purely diagnostic: it executes /usr/bin/id and redirects output to /tmp/.cve-2026-49009, providing a simple proof of code execution inside the worker container. Matchers verify successful authentication, extraction of a JWT, a successful artifact generation response, and the presence of a Location header. This makes the template intrusive and exploitative, not merely a passive detector. Repository structure is straightforward: the YAML file is the only code artifact and the effective entry point; README.md documents the vulnerability, attack flow, affected versions, and references, and also mentions additional PoC material, but no Python exploit source is actually present in the repository snapshot provided. Overall, the repository's purpose is to provide an authenticated Nuclei-based exploit/verification template for path traversal leading to container-level RCE in vulnerable Mender Server deployments.

Repository is a small standalone Python PoC for CVE-2026-49009 targeting Mender Server’s authenticated single-file artifact generation workflow. Structure is minimal: LICENSE, a detailed README describing the vulnerability and impact, and exploit.py containing the full exploit logic. The exploit authenticates to the Mender management API, obtains a token, constructs a malicious shell-script payload, and submits a multipart artifact-generation request to /api/management/v1/deployments/artifacts/generate. The key exploit primitive is attacker control over args.filename, set to ../../../../usr/bin/mender-artifact, which abuses path traversal to overwrite a trusted executable inside the artifact worker container. When the workflow later invokes mender-artifact, the attacker-controlled script runs an arbitrary user-supplied command inside the backend worker. The script supports command-line parameters for target URL, username, password, and command to execute; it disables TLS verification for lab/self-signed setups and extracts the workflow job ID from the HTTP Location header. Overall, this is a real authenticated RCE exploit, not merely a detector, with a hardcoded but user-customizable command-execution payload.