Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability has been identified in the /api/opencode proxy endpoint, which could allow remote attackers to execute file operations outside the intended project directory on the host system. This issue stems from improper validation of a specific request header.
- Directory control issue in an API proxy.
- Matters if external systems interact with this API.
- Confirm relevance and exposure of this proxy endpoint.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this vulnerability by sending a specially crafted request to the `/api/opencode` endpoint. This request would target the `x-opencode-directory` header, which is not properly validated. If successful, an attacker could manipulate file operations on the host system, potentially leading to unauthorized execution of code or access to sensitive data.
- Network access to the API endpoint is required.
- A crafted request to the `/api/opencode` endpoint triggers the vulnerability.
- Enables arbitrary file operations outside the project.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an unauthenticated attacker to execute arbitrary file operations outside of a project's root directory on the host system. This is possible when the affected system processes requests to the `/api/opencode` proxy endpoint without properly validating the `x-opencode-directory` header.
- Host file system access.
- Via manipulated request headers.
- Unauthorized file operations on host.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability resides in an API endpoint commonly exposed externally. Application owners or platform teams are likely responsible for managing this technology. The first step is to inventory all instances of the affected technology, assess their exposure, and identify the business-critical systems to prioritize remediation efforts.
- Application and platform teams own the issue.
- Verify external exposure and critical systems first.
- Plan remediation based on identified risk.
