# Pre-auth endpoint to command execution

Unauthenticated routes feeding request fields into exec, ssh argv, or executable selection

_Area: Web injection and code execution. Seen in 2 disclosed reports; latest 2026-05-19. Updated 2026-11-07._

## How it works

An endpoint meant to be reachable without credentials passes a request-controlled value into a command runner: an executable path, an argv token, or an option string. The code assumes "this endpoint is harmless" or "this field is config, not input," but the value reaches `exec`, `spawn`, or an ssh argv where a token like `-oProxyCommand=...` is interpreted by the shell or by OpenSSH. The broken assumption is that authentication or a config default protects the sink; when auth is absent or silently disabled, the sink is directly reachable [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-2q4c-3mrw-63c3.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wvr4-3wq4-gpc5.md).

## Where it shows up

- Auth helpers that authorize everything when the authenticator is nil, or guards wrapped in `if (token)` where the default token is empty [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-2q4c-3mrw-63c3.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wvr4-3wq4-gpc5.md).
- Config fields (sshArguments, proxy settings, serverPath, args) split on spaces and appended to an argv [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-2q4c-3mrw-63c3.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wvr4-3wq4-gpc5.md).
- Any `-o`-style option reaching OpenSSH, which runs `ProxyCommand` through `$SHELL -c` [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-2q4c-3mrw-63c3.md).
- Body fields passed straight to a transport/exec constructor with no allowlist [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wvr4-3wq4-gpc5.md).
- A log warning instead of a fatal error when auth config is unset [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wvr4-3wq4-gpc5.md).

## How to review

Trace every unauthenticated route to its sinks. The invariant: no request-controlled value may reach an executable name, an argv element, or a shell-interpreted option unless it is validated against a strict allowlist. Check the auth guard's default branch: does an unset/empty token fail closed? Check argv construction: is user input ever space-split into tokens, and can it introduce an option (leading `-`) rather than a value? For ssh, treat any user-influenced `-o` as command execution [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-2q4c-3mrw-63c3.md).

## How finders spotted it

- Read the authz path (`server_authz_checks.go`), saw a nil authenticator authorizes all UI endpoints, then read `sftp_storage.go` where sshArguments is space-split into argv, and recalled OpenSSH's `-oProxyCommand` shell semantics [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-2q4c-3mrw-63c3.md).
- Read `config.ts` and `http-server.ts`: noticed the token defaults to empty string and the guard is `if (this.accessToken)`, a falsy check that skips enforcement; then traced `/bridge` body fields into command execution [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wvr4-3wq4-gpc5.md).

## Variants seen

- No-auth server mode turning a shared authz helper into an open door to an ssh argv sink [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-2q4c-3mrw-63c3.md).
- Falsy-default token disabling auth middleware, exposing an executable-path field [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wvr4-3wq4-gpc5.md).

## Impact and severity

Unauthenticated remote code execution, the highest severity [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-2q4c-3mrw-63c3.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wvr4-3wq4-gpc5.md). In both cases the only precondition was a default or documented configuration (server started without a password, token left unset), so the attack surface is every deployment that never set credentials [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-2q4c-3mrw-63c3.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wvr4-3wq4-gpc5.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **github.com/kopia/kopia (go)** <= 0.22.3, fixed in 0.23.0: Kopia: RCE via SSH ProxyCommand Injection (CVE-2026-45695). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-2q4c-3mrw-63c3.md. Fix: https://github.com/kopia/kopia/pull/5354
- **mcp-bridge (npm)** <= 2.0.0, no fix yet: MCP Connect has unauthenticated remote OS command execution via /bridge endpoint. Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-wvr4-3wq4-gpc5.md

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-2q4c-3mrw-63c3.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-wvr4-3wq4-gpc5.md
- E3: https://bugbountylibrary.com/r/h1%3A696276.md