High, CVSS 7.5npmAmendedPublished
TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop
GHSA-7q9c-hpx7-9cwm
- Affected
- npm @typespec/spector <= 0.1.0-alpha.26
- Fixed in
- 0.1.0-alpha.27· Vendor fix available
- Issue
- @typespec/spector registers a POST /.admin/stop HTTP route with no authentication, authorization token, Origin check, or IP-source restriction. Any network-reachable client can send a single unauthenticated POST request to terminate the mock server process. Because the server binds to 0.0.0.0 by default (all interfaces), this endpoint is exposed to any host that can reach the server's port—not just localhost—making a complete denial-of-service trivially achievable with one HTTP request. Severity is High (CVSS 7.5). Details The vulnerability originates in packages/spector/src/routes/admin.ts at line 7, where an Express router registers the shutdown endpoint with no authentication middleware whatsoever: The constant AdminUrls.stop resolves to /.admin/stop (packages/spector/src/constants.ts:1-3). The complete attack-reachable call chain is: 1. packages/spector/src/cli/cli.ts:139-166 — tsp-spector serve <scenariosPaths.. starts the server on default port 3000. No host option is…
Recommended action: Upgrade to 0.1.0-alpha.27 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.