Vulnerability GHSA-7m8x-x364-m26j

Summary

An unauthenticated WebSocket client can subscribe to the log path and receive buffered server logs.

WebSocket connections are intentionally permitted before authentication because login occurs over the WebSocket connection. However, the log subscription path does not enforce an authorization check.

processSubscribe handles subscriptions to the log path separately, without applying access control:

if (
  Array.isArray(msg.subscribe) &&
  msg.subscribe.length > 0 &&
  msg.subscribe[0].path === 'log'
) {
  if (!spark.logUnsubscribe) {
    spark.logUnsubscribe = startServerLog(app, spark)
  }
} else {
  // normal subscriptions go through subscriptionmanager, which applies
  // securityStrategy.filterReadDelta
}

startServerLog then replays the whole buffer to that socket:

app.logging.getLog().forEach((log) => {
  spark.write({ type: 'LOG', data: log })
})

The asymmetry is inside this one file. Writes are gated by securityStrategy.shouldAllowWrite (ws.ts:961), normal delta subscriptions are filtered by securityStrategy.filterReadDelta (ws.ts:1159, the else branch of this same function), and the log branch consults neither.

An unauthenticated socket, which is legitimately open for login, can subscribe to log and receive buffered server logs.

Fix: Requires an administrator principal, before startServerLog, in the same way the other branch defers to securityStrategy. The fix was released with version 2.31.0-beta.1.

The investigated code path was reviewed at commit 26ab199. No server was run and no WebSocket frames were captured. AI assistance was used during the investigation.