CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion

Vulnerability

The cloakserve CDP multiplexer, part of the CloakBrowser project, accepts a user-supplied fingerprint query parameter that is used directly as a filesystem path component when creating Chrome profile directories. By default, cloakserve binds to 0.0.0.0, making it network-accessible. An unauthenticated attacker can supply a crafted fingerprint value containing path traversal sequences (e.g., ../), causing the resulting user_data_dir to resolve outside the intended data_dir. Affected versions are those prior to v0.3.28.

Exploitation

An attacker who can reach the cloakserve port (default network exposure) sends an HTTP request with a malicious fingerprint parameter containing path traversal sequences. The service uses this value to construct a path for a Chrome profile directory. When Chrome fails to start or the process is cleaned up, shutil.rmtree() is called on the constructed path, deleting the traversed directory. No authentication is required; only network access to the cloakserve port is needed [1][2][3].

Impact

Successful exploitation allows an unauthenticated attacker to delete arbitrary directories on the filesystem that are accessible to the service user. This can lead to data loss, denial of service, and potential disruption of the host system or other services [1][2][3].

Mitigation

The vulnerability is fixed in version v0.3.28. Users should upgrade to this version or later. As a workaround, restrict network access to the cloakserve port to only trusted hosts, for example by using a firewall or binding the service to 127.0.0.1 instead of 0.0.0.0 [1][2][3].