LaunchPad - Devlog #2
I have once again worked on the project
I have scanned the code on vulnerabilities with use of several scans and with help of ai.
I have patches those issues after it.
Also I have commented a bit more to clarify things in the code.
This devlog brings no new features.
What’s done so far:
As I said I patched several vulnerabilities. I listed them below.
Critical (2):
Hardcoded fallback API key in three separate locations (src/api/auth.rs, src/api/tokens.rs, src/api/websocket.rs, src/config/loader.rs, .env)
Path traversal + shell injection in file endpoints (src/api/files.rs)
High (5)
WebSocket shell auth via URL query param with key logged in access logs (src/api/websocket.rs, src/api/routes.rs)
Unrestricted Docker image pull with ImagePolicy never enforced (src/api/apps.rs, src/docker/policy.rs)
SSRF via unvalidated webhook URLs (src/api/webhooks.rs, src/api/apps.rs, src/api/power.rs)
App tokens stored and compared as plaintext (src/db/queries.rs, migrations/0002_extras.sql)
Wildcard CORS allowing any origin to make credentialed requests (src/main.rs)
Medium (5)
Signal injection via kill endpoint allowing arbitrary OS signal to any process (src/api/power.rs)
Port allocator state is in-memory only and not persisted across restarts (src/server/ports.rs, src/server/state.rs)
No rate limiting on any endpoint (src/main.rs, src/api/auth.rs)
Containers launched with default capabilities and no security hardening (src/docker/client.rs)
Port mappings added to database without rebinding Docker causing state desync (src/api/ports.rs, README.md)
Low (3)
App name unsanitised and used in Docker network names and host filesystem paths (src/api/apps.rs, src/api/network.rs)
Environment variables passed to containers without validation leading to potential secret leakage (src/api/apps.rs, src/docker/client.rs)
Timing side-channel in API key comparison (src/api/auth.rs, src/api/tokens.rs, src/api/websocket.rs)
Informational (3)
Raw internal errors returned to API callers (src/api/* all handlers)
/servers endpoint exposes host hardware and Docker internals to all authenticated callers (src/api/servers.rs)
container_id exposed in app responses (src/server/state.rs, src/api/apps.rs)
I have patches them all so it should be safe now. If you find more, please report them.
What’s next
The same as I said in last devlog. The panel itself.
I have made this devlog since I found a couple issues while testing and they were related to the security of the app.
Changelog
