CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2. Vulnerability Description

CVE-2024-31218 is caused by insufficient authentication protection around administrator creation in the affected Webhood/PocketBase application.

When the application has no administrator account configured, the administrator creation functionality can be reached without authentication.

An attacker capable of reaching the affected API can therefore attempt to create the first administrator account.

Successful exploitation can result in administrative access to the application.

The vulnerability is classified as:

CWE-306: Missing Authentication for Critical Function
3. Affected and Fixed Versions

The vulnerable range is:

Webhood <= 0.9.0

The vulnerability was fixed in:

Webhood 0.9.1

The patched version should therefore be used for remediation verification.

4. Attack Surface

The relevant attack surface is the PocketBase administrative API.

The vulnerable functionality involves administrator account creation.

Conceptually, the attack flow is:

Attacker
   |
   | HTTP request
   v
Webhood / PocketBase API
   |
   | Administrator creation endpoint
   v
Admin account creation
   |
   v
Unauthorized administrative access

The attack does not require an existing authenticated session when the vulnerable initial-administrator condition is present.

5. Root Cause

The root cause is an authentication control failure.

The administrator creation functionality did not sufficiently restrict access when no administrator account existed.

The security boundary should ensure that privileged administrative functionality cannot be abused by an unauthenticated remote client.

The vulnerable behavior therefore represents a missing authentication check around a security-sensitive operation.

6. Controlled Lab Architecture

The laboratory reproduces the PocketBase administrative API behavior
underlying CVE-2024-31218.

The Docker environment uses the PocketBase component directly rather than
claiming to package the complete Webhood 0.9.0 application.

The laboratory architecture is:

+-------------------------+
|       Host Machine      |
|                         |
|  PowerShell / Python    |
+------------+------------+
             |
             | 127.0.0.1:8090
             v
+-------------------------+
|     Docker Container    |
|                         |
|  +-------------------+  |
|  |    PocketBase     |  |
|  | Administrative API|  |
|  +-------------------+  |
|                         |
+-------------------------+

The service is bound to localhost only and is not intended to be exposed
to the public Internet.

All credentials used during reproduction are synthetic laboratory credentials.

7. Repository Structure
CVE-2024-31218-WEBHOOD-LAB/
│
├── README.md
│
├── vulnerable/
│   ├── Dockerfile
│   └── docker-compose.yml
│
├── exploit/
│   └── reproduce.py
│
├── detection/
│   └── detect.py
│
├── patched/
│   └── README.md
│
├── evidence/
│   └── README.md
│
└── blog/
    └── CVE-2024-31218-Technical-Blog.pdf

8. Vulnerable Environment

The vulnerable environment is designed to reproduce the PocketBase
administrative API behavior associated with CVE-2024-31218 in an isolated
Docker container.

The lab uses PocketBase directly as the affected component rather than
claiming to reproduce the complete Webhood 0.9.0 application.

The Docker configuration will:

- Build the laboratory environment.
- Start PocketBase locally.
- Bind the service to localhost.
- Keep the service isolated from external systems.
- Provide a reproducible environment for testing.
- Allow the reproduction script to interact with the administrative API.

The current laboratory uses a synthetic administrator account and does not
contain real user data or credentials.

9. Reproduction Methodology

The reproduction procedure is designed only for the local laboratory.

Step 1 — Start the vulnerable container
docker compose up --build
Step 2 — Verify the service

Confirm that the PocketBase service used for the component-level laboratory is responding locally.

Step 3 — Execute the controlled reproduction script

The reproduction script will send the relevant request to the local vulnerable instance.

Example:

python exploit/reproduce.py
Step 4 — Observe the response

The response should demonstrate whether the application accepts the unauthenticated administrator creation request.

Step 5 — Verify the resulting state

The lab should verify whether an administrator account was created.

No external target should ever be used.

10. Detection

Detection should identify indicators associated with unauthorized administrator creation attempts.

Potential indicators include:

Requests to administrator creation functionality
Unauthenticated requests to administrative endpoints
Unexpected creation of a first administrator account
HTTP requests originating from an unexpected client
Repeated administrator creation attempts
Administrative account creation immediately after application initialization

The detection script is located in:

detection/detect.py

11. Remediation

The primary remediation is to upgrade Webhood to the fixed version:

Webhood 0.9.1

The vulnerable release should not be used in production.

A documented workaround is to restrict access to the affected administrator API functionality where an upgrade cannot immediately be performed.

After remediation:

Stop the vulnerable container.
Replace the vulnerable version with the fixed version.
Rebuild the container.
Start the patched environment.
Repeat the reproduction attempt.
Confirm that the vulnerable behavior is no longer possible.
Review application logs for unexpected administrative requests.

12. Remediation and Verification

The official Webhood fix for CVE-2024-31218 was verified using the actual Webhood `v0.9.1` source release.

The fixing commit is:

`735e7fa2814edeec9a2c07778ed51b3c018609f9`

The fix adds the migration:

`src/backend/migrations/1712252550_generate_random_admin.js`

The migration checks whether an administrator already exists. If no administrator exists, it creates an administrator account with a randomly generated password. This prevents an unauthenticated requester from claiming the first administrator through the exposed `/api/admins` endpoint.

#### Verification procedure

1. The official Webhood `v0.9.1` source tag was checked out.
2. The backend was built locally from the official source using its Dockerfile.
3. The resulting image was run on localhost at port `8091`.
4. The same unauthenticated administrator-creation request used against the vulnerable laboratory was replayed against the fixed backend.
5. The vulnerable environment previously accepted the request with HTTP `200`.
6. The fixed `v0.9.1` backend rejected the same request with HTTP `401`.

Observed fixed-environment response:

```text
HTTP status: 401
{"code":401,"message":"The request requires valid admin authorization token to be set.","data":{}}

This confirms that the previously demonstrated unauthenticated administrator-creation attack path was blocked in the locally built Webhood v0.9.1 backend.

REMEDIATION VERIFIED: YES

Evidence:

evidence/05-remediation-verified.png

13. Security Impact

Successful exploitation may provide administrative privileges to an unauthorized party.

Potential consequences include:

Unauthorized administrative access
Modification of application data
Exposure of application information
Modification or deletion of records
Further administrative abuse of the application

The severity is therefore classified as Critical according to the published CVSS assessment.

14. Evidence

The evidence/ directory is intended to contain screenshots demonstrating:

Vulnerable application startup
Docker container status
Vulnerable version
Reproduction request
Successful vulnerable behavior
Detection output
Patched version
Failed/blocked reproduction after remediation

Screenshots should not contain real credentials, personal information, API keys, or other sensitive data.

15. Limitations

During preparation of this laboratory, the local Windows environment encountered problems starting the Docker Linux backend.

Windows returned:

Error: 14098
The component store has been corrupted.

The required Windows features were also initially disabled:

VirtualMachinePlatform
Microsoft-Windows-Subsystem-Linux

Therefore, any reproduction result or screenshot must accurately distinguish between:

Vulnerability research
Lab configuration
Intended reproduction procedure
Successfully executed reproduction

No successful exploit execution should be claimed unless it has actually been performed in the isolated laboratory.

16. Safety Considerations

This project is intended for authorized security research only.

The laboratory should:

Run locally.
Avoid public exposure.
Avoid real credentials.
Avoid real user data.
Avoid testing against third-party systems.
Use disposable test accounts.
Use an isolated Docker network.
Destroy the vulnerable environment after testing.

Example cleanup:

docker compose down
17. References
National Vulnerability Database — CVE-2024-31218
Webhood security advisory
Webhood/PocketBase source repository
Fixing commit associated with CVE-2024-31218
CWE-306 — Missing Authentication for Critical Function
FIRST CVSS v3.1 specification
18. Disclaimer

This repository is a cybersecurity education and vulnerability research project.

The vulnerable configuration is intentionally reproduced for controlled testing. It must not be deployed as a publicly accessible service.

The author assumes no responsibility for unauthorized use of the techniques or artifacts contained in this repository.