【严重】9router 安全更新（GHSA-qvfm-67h2-2qfx）

安全情报快照 · 风险级别：严重 · CVSS：9.9 · CVE-2026-55500 · GHSA-qvfm-67h2-2qfx

先看结论

9router存在安全风险，<= 0.4.71 受影响。上游暂未提供明确修复版本。

影响范围

生态	组件	受影响版本	首个修复版本
npm	`9router`	<= 0.4.71	—

处置建议

上游公告暂未给出明确修复版本。请持续关注项目维护者发布的补丁，并结合受影响版本范围排查资产。

上游技术详情（原文）

Summary

The /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. Combined with other vulnerabilities (e.g., default password, tunnel exposure), this enables complete database takeover.

Description

The endpoint /api/settings/database is listed in ALWAYS_PROTECTED in dashboardGuard.js (line 42), which requires a valid JWT token or CLI token. However, this protection is insufficient because:

GET (Export): Returns the complete database including API keys (key field in apiKeys table), OAuth tokens, and all provider credentials. Line 80 in src/lib/db/index.js: apiKeys: db.all("SELECT * FROM apiKeys").map(...) — the key field contains the plaintext API key value.
POST (Import): Accepts arbitrary JSON and performs a complete database wipe-and-replace in a transaction (lines 102-163 in src/lib/db/index.js). This replaces all settings including the password hash, effectively allowing an attacker to set their own password.
The exported data includes apiKeys with their plaintext key values, providerConnections with all OAuth tokens, and settings with OIDC client secrets.

Evidence

File: src/app/api/settings/database/route.js

export async function GET() {
  const payload = await exportDb();
  return NextResponse.json(payload);
}

export async function POST(request) {
  const payload = await request.json();
  await importDb(payload);
  // ...
}

File: src/lib/db/index.js (lines 96-163)

export async function importDb(payload) {
  db.transaction(() => {
    // Wipe all tables
    db.run(`DELETE FROM settings`);
    db.run(`DELETE FROM providerConnections`);
    db.run(`DELETE FROM providerNodes`);
    db.run(`DELETE FROM proxyPools`);
    db.run(`DELETE FROM apiKeys`);
    db.run(`DELETE FROM combos`);
    db.run(`DELETE FROM kv WHERE scope IN (...)`);
    // Then insert attacker-controlled data
    // ...
  });
}

The exportDb function at line 80 exposes API key plaintext:

apiKeys: db.all(`SELECT * FROM apiKeys`).map((r) => ({ 
  id: r.id, key: r.key, name: r.name, ...
})),

Steps to Reproduce

Authenticate with any valid JWT (e.g., using the default password "123456")
Export: curl -b auth_token=<jwt> http://localhost:20128/api/settings/database
Observe: Full database dump with all credentials in plaintext
Import malicious data: curl -X POST -b auth_token=<jwt> -H "Content-Type: application/json" -d '<modified-db>' http://localhost:20128/api/settings/database
All settings, passwords, API keys are now replaced with attacker-controlled values

Impact

Confidentiality: Complete exposure of all stored secrets (API keys, OAuth tokens, OIDC client secrets)
Integrity: Complete database replacement with attacker-controlled data
Availability: Database wipe is possible by importing an empty database
Scope Changed: Importing new settings affects all users and downstream services

Recommended Fix

Require re-authentication for database export/import (not just an existing session)
Mask/redact API keys in export (or require explicit opt-in for key export)
Add confirmation step for import (require current password verification)
Implement database backup before import
Log all export/import operations with audit trail

来源与许可

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。