Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a path traversal issue in the cloakserve script of CloakBrowser, which can lead to arbitrary directory deletion. The analysis of the patch commit babef04e07b9ac91ca28994b18a6f81b26d1192a reveals the root cause and the affected functions.
Input-based Path Creation: The ChromePool.get_or_create function takes a seed from the user-supplied fingerprint query parameter. This seed was used directly to construct a path for a Chrome user profile directory (user_data_dir). The lack of sanitization allowed an attacker to inject path traversal characters (e.g., ../) and craft a path pointing to an arbitrary location on the filesystem.
Unsafe Deletion: The created directory was later deleted using shutil.rmtree. This deletion could be triggered in two primary scenarios:
ChromePool.get_or_create itself, if the Chrome process failed to start.ChromePool.disconnect function, which is called to clean up a session.Network Exposure: The main function in cloakserve previously bound the web server to 0.0.0.0 by default, exposing the vulnerable endpoint to the network and making the attack possible for any unauthenticated user with network access to the port.
The patch addresses these issues by:
ChromePool.get_or_create using a regular expression (SAFE_SEED_RE) to ensure the seed is a simple alphanumeric string.shutil.rmtree in both get_or_create and disconnect with a new _safe_rmtree method. This new method verifies that the path to be deleted is located within the designated data directory, preventing deletion outside of it.main function to 127.0.0.1 for bare-metal installations, limiting network exposure by default.Therefore, ChromePool.get_or_create is the primary vulnerable function where the path traversal is initiated, and ChromePool.disconnect is also a key component as it provides another vector to trigger the malicious deletion.
ChromePool.get_or_createbin/cloakserve
ChromePool.disconnectbin/cloakserve
mainbin/cloakserve
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| cloakbrowser | pip | <= 0.3.27 | 0.3.28 |