CyberRota Analysis
AI-GeneratedVersions 4.4.1 through 5.3.5 of the UpSnap wake-on-LAN web application are critically vulnerable due to a missing authentication mechanism in the `pb.HandlerInitSuperuser` function, allowing unauthenticated attackers to register a superuser account and gain long-lived JWT access. This vulnerability can lead to remote code execution, posing a significant risk to systems using these versions. Organizations utilizing UpSnap should prioritize upgrading to version 5.4.0 or later to mitigate this severe security threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerInitSuperuser` (`backend/pb/handlers.go:249`), reachable as `POST /api/upsnap/init-superuser`. The vulnerable code lacks any authentication, setup token, IP allow-list, or rate limit and is gated only by a `totalSuperusers > 0` count check — a condition that is false on every fresh install — allowing an unauthenticated network-adjacent attacker to register the initial superuser account, receive a long-lived JWT, and pivot to root remote code execution at `backend/networking/wake.go:43` (`exec.CommandContext(ctx, "/bin/sh", "-c", wake_cmd)`). Version 5.4.0 fixes the issue.