Fix CVE-2026-62661 JFSA rendering: restore Description and PoC

Author: yuvalmo-jfrog

vulnerabilities/the-reachy-mini-bluetooth-command-handler-is-vulnerable-to-arbitrary-root-script-execution-via-path-traversal-cve-2026-62661.md

@@ -29,10 +29,21 @@ reachy-mini (Bluetooth command service)
 
 ## Description
 
-The Reachy Mini Bluetooth command handler (BluetoothCommandService._handle_command in src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py) accepts a CMD_<script> payload after a successful PIN authentication and runs the matching file from the commands/ directory with sudo. The script name is taken from the BLE payload with no sanitization and combined using os.path.join("commands", script_name). On POSIX, if the second argument is an absolute path, os.path.join discards the commands/ prefix entirely, so a payload such as CMD_/tmp/reachy_pwn causes the handler to execute sudo /tmp/reachy_pwn.sh. Relative payloads such as CMD_../attacker/pwn likewise escape the intended directory. An attacker who can place a .sh file on the filesystem — for example via the unrestricted media-sounds upload (CVE-2026-55419) — can therefore run that script as root.
+The Reachy Mini Bluetooth command handler (`BluetoothCommandService._handle_command` in `src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py`) accepts a `CMD_` payload after a successful PIN authentication and runs the matching `.sh` file from the `commands/` directory with `sudo`. The script name is taken from the BLE payload with no sanitization and combined using `os.path.join("commands", script_name)`. On POSIX, if the second argument is an absolute path, `os.path.join` discards the `commands/` prefix entirely, so a payload such as `CMD_/tmp/reachy_pwn` causes the handler to execute `sudo /tmp/reachy_pwn.sh`. Relative payloads such as `CMD_../attacker/pwn` likewise escape the intended directory. An attacker who can place a `.sh` file on the filesystem, for example via the unrestricted media-sounds upload (CVE-2026-55419), can therefore run that script as root.
 
 This issue is the third step in a documented compromise chain: unrestricted file upload, Bluetooth authentication bypass, then this directory traversal. The published CVSS score (7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects authenticated Bluetooth access.
 
+The vulnerable join looks like this:
+
+```
+script_name = command_str[4:].strip() + ".sh"
+script_path = os.path.join("commands", script_name)
+if os.path.isfile(script_path):
+    subprocess.run(["sudo", script_path], capture_output=True, text=True)
+```
+
+Python documents that an absolute second argument replaces the earlier join pieces, so `os.path.join("commands", "/tmp/reachy_pwn.sh")` evaluates to `/tmp/reachy_pwn.sh`.
+
 ## PoC
 
 <br>
@@ -42,7 +53,7 @@ This issue is the third step in a documented compromise chain: unrestricted file
 <br>
 
 ```
-python3 -c "import os; print(os.path.join('commands', '/tmp/reachy_pwn.sh'))"
+python3 -c "import os; print(os.path.join('commands', '/tmp/reachy_pwn.sh')); print(os.path.join('commands', '../attacker/pwn.sh'))"
 ```
 
 <br>
@@ -51,22 +62,23 @@ Expected output:
 
 ```
 /tmp/reachy_pwn.sh
+../attacker/pwn.sh
 ```
 
 <br>
 
-The first argument is discarded because the second argument is an absolute path.
+The first argument is discarded when the second argument is an absolute path. A `../` segment also leaves `commands/`.
 
 <br>
 
 **Step 2 - Authenticate on the Bluetooth command characteristic**
 
 <br>
 
-From a BLE client (nRF Connect, Web Bluetooth, or the Reachy Mini control app), write the robot PIN as:
+From a BLE client (nRF Connect, Web Bluetooth, or the Reachy Mini control app), write the robot PIN. The handler expects the `PIN_` prefix followed by the last five digits of the serial, for example:
 
 ```
-PIN_<last_5_digits_of_serial>
+PIN_12345
 ```
 
 <br>
@@ -99,15 +111,24 @@ On a vulnerable build this resolves to `sudo /tmp/reachy_pwn.sh` instead of a fi
 
 <br>
 
-On a Linux checkout of reachy_mini 1.10.0 or later:
+The vendor shipped `tests/unit_tests/test_ble_path_traversal.py` with the fix. On a Linux checkout of an unpatched tree, copy that test in and run:
 
 ```
 pytest tests/unit_tests/test_ble_path_traversal.py -v
 ```
 
 <br>
 
-Those tests assert that the handler never invokes sudo on a path outside `commands/`. They fail against unpatched trees (PATH TRAVERSAL: handler invoked sudo ...) and pass once the command name is constrained to a bare `[A-Za-z0-9_-]+` filename.
+Expected output on a vulnerable build:
+
+```
+PATH TRAVERSAL: handler invoked `sudo ...` for payload ...
+FAILED tests/unit_tests/test_ble_path_traversal.py
+```
+
+<br>
+
+Those tests assert that the handler never invokes sudo on a path outside `commands/`. They fail while the vulnerability is present and pass once the command name is constrained to a bare `[A-Za-z0-9_-]+` filename.
 
 ## Vulnerability Mitigations