# Unauthenticated restore and setup endpoints

Setup, restore, or config-import routes reachable without auth that accept uploads or overwrite config

_Area: Web infrastructure and server-side requests. Seen in 2 disclosed reports; latest 2026-05-06. Updated 2026-11-02._

## How it works
A restore or setup route is meant to run only in a narrow window (fresh install, first boot) or behind re-authentication. The assumption that breaks is that this window is closed or guarded. In practice the route is mounted on the root router with only a weak middleware (IP allowlist, or an "auth if installed" check that skips auth while a secret is empty or startup is recent), so an unauthenticated caller can push a backup or config file that overwrites live configuration. Because the overwritten config is later executed or trusted, the write becomes code execution or admin takeover [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-4pvg-prr3-9cxr.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment.md).

## Where it shows up
- Restore/import/setup routes (`/api/restore`, `/json/setup-restore.action`) registered on the root group rather than an authenticated group [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-4pvg-prr3-9cxr.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment.md).
- Auth middleware with a time- or state-bounded bypass: empty `JwtSecret`, `startupTime < 10min`, "not yet installed" flags [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-4pvg-prr3-9cxr.md).
- Integrity checks whose HMAC key is derived from a caller-supplied value (e.g. the AES key in the upload) [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-4pvg-prr3-9cxr.md).
- Config fields that become shell commands (`TestConfigCmd`) or module loads (`load_module`, `js_import`) after import [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-4pvg-prr3-9cxr.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-5r62-gj48-897x.md).
- The same privileged write exposed over a second interface (HTTP API vs MCP/agent tools) [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-5r62-gj48-897x.md).

## How to review
For every restore/setup/import route, confirm the invariant: **the handler cannot run without a verified authenticated principal, and any integrity check uses a server-held key, not request data.** Check:
- Is the route on the authenticated group, or does its middleware actually enforce auth in all states (installed, fresh, within startup window)?
- Does the signature/HMAC key come from server config only? If it traces back to the request, the check is void [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-4pvg-prr3-9cxr.md).
- Does the imported file overwrite config that is later executed? Trace each field to its sink [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-4pvg-prr3-9cxr.md).
- When a privileged operation exists on multiple interfaces, does each path call the same validation (e.g. `ValidateConfigFile`)? [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-5r62-gj48-897x.md)
- Do admin restore actions require re-auth (WebSudo)? [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment.md)

## How finders spotted it
- Read router registration and noticed `backup.InitRouter` mounted on the root group with only IPWhiteList, then traced the time-bounded auth bypass and the self-referential HMAC key to the config overwrite and shell sink [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-4pvg-prr3-9cxr.md).
- Compared the HTTP config API's restricted-directive validation against the MCP config tool path, saw the MCP path lacked the check, then tested equivalent restricted content via MCP [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-5r62-gj48-897x.md).
- Detected an encoded PowerShell downloader via existing detections, then traced the payload back to the setup-restore endpoint [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment.md).

## Variants seen
- Fresh-install auth bypass plus config overwrite to RCE [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-4pvg-prr3-9cxr.md).
- Secondary-interface validation gap allowing restricted directives/NJS execution [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-5r62-gj48-897x.md).
- Missing re-auth on setup-restore enabling admin creation and ransomware [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment.md).

## Impact and severity
Root RCE on the host in Docker with mounts/privileged mode [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-4pvg-prr3-9cxr.md); code execution in the Nginx worker [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-5r62-gj48-897x.md); admin account creation chained to web shell and ransomware deployment [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment.md). Severity rises with process privilege, host mounts, and chaining to plugin/web-shell install [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-4pvg-prr3-9cxr.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **github.com/0xJacky/nginx-ui (go)** < 2.3.8, fixed in 2.3.8: Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore (CVE-2026-42238). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-4pvg-prr3-9cxr.md
- **Confluence Data Center and Confluence Server** (/json/setup-restore.action) (version not stated): Confluence to Cerber: Exploitation of ​​CVE-2023-22518 (CVE-2023-22518). Report: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment.md

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-4pvg-prr3-9cxr.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-5r62-gj48-897x.md
- E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment.md