chandrimanath04-hue/cve-2024-31218-webhood-labDocker-based lab reproducing CVE-2024-31218, an unauthenticated PocketBase admin creation flaw in Webhood, with PoC, detection, and remediation verification.
This project is a controlled security research and vulnerability reproduction lab for CVE-2024-31218, a critical authentication vulnerability affecting Webhood versions prior to 0.9.1.
The vulnerability is related to the unauthenticated creation of a PocketBase administrator account when no administrator account exists. An attacker who can reach the affected API may be able to create an administrative account without prior authentication.
The objective of this lab is to:
Safety: This project is intended only for an isolated local laboratory environment. The vulnerable application must never be exposed to the public Internet or used against systems without authorization.
| Field | Details |
|---|---|
| CVE | CVE-2024-31218 |
| Project | Webhood |
| Affected versions | Webhood <= 0.9.0 |
| Fixed version | Webhood 0.9.1 |
| Severity | Critical |
| CVSS v3.1 | 9.8 |
| CWE | CWE-306 — Missing Authentication for Critical Function |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Confidentiality | High |
| Integrity | High |
| Availability | High |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2. Vulnerability Description
CVE-2024-31218 is caused by insufficient authentication protection around administrator creation in the affected Webhood/PocketBase application.
When the application has no administrator account configured, the administrator creation functionality can be reached without authentication.
An attacker capable of reaching the affected API can therefore attempt to create the first administrator account.
Successful exploitation can result in administrative access to the application.
The vulnerability is classified as:
CWE-306: Missing Authentication for Critical Function
3. Affected and Fixed Versions
The vulnerable range is:
Webhood <= 0.9.0
The vulnerability was fixed in:
Webhood 0.9.1
The patched version should therefore be used for remediation verification.
4. Attack Surface
The relevant attack surface is the PocketBase administrative API.
The vulnerable functionality involves administrator account creation.
Conceptually, the attack flow is:
Attacker
|
| HTTP request
v
Webhood / PocketBase API
|
| Administrator creation endpoint
v
Admin account creation
|
v
Unauthorized administrative access
The attack does not require an existing authenticated session when the vulnerable initial-administrator condition is present.
5. Root Cause
The root cause is an authentication control failure.
The administrator creation functionality did not sufficiently restrict access when no administrator account existed.
The security boundary should ensure that privileged administrative functionality cannot be abused by an unauthenticated remote client.
The vulnerable behavior therefore represents a missing authentication check around a security-sensitive operation.
6. Controlled Lab Architecture
The laboratory reproduces the PocketBase administrative API behavior
underlying CVE-2024-31218.
The Docker environment uses the PocketBase component directly rather than
claiming to package the complete Webhood 0.9.0 application.
The laboratory architecture is:
+-------------------------+
| Host Machine |
| |
| PowerShell / Python |
+------------+------------+
|
| 127.0.0.1:8090
v
+-------------------------+
| Docker Container |
| |
| +-------------------+ |
| | PocketBase | |
| | Administrative API| |
| +-------------------+ |
| |
+-------------------------+
The service is bound to localhost only and is not intended to be exposed
to the public Internet.
All credentials used during reproduction are synthetic laboratory credentials.
7. Repository Structure
CVE-2024-31218-WEBHOOD-LAB/
│
├── README.md
│
├── vulnerable/
│ ├── Dockerfile
│ └── docker-compose.yml
│
├── exploit/
│ └── reproduce.py
│
├── detection/
│ └── detect.py
│
├── patched/
│ └── README.md
│
├── evidence/
│ └── README.md
│
└── blog/
└── CVE-2024-31218-Technical-Blog.pdf
8. Vulnerable Environment
The vulnerable environment is designed to reproduce the PocketBase
administrative API behavior associated with CVE-2024-31218 in an isolated
Docker container.
The lab uses PocketBase directly as the affected component rather than
claiming to reproduce the complete Webhood 0.9.0 application.
The Docker configuration will:
- Build the laboratory environment.
- Start PocketBase locally.
- Bind the service to localhost.
- Keep the service isolated from external systems.
- Provide a reproducible environment for testing.
- Allow the reproduction script to interact with the administrative API.
The current laboratory uses a synthetic administrator account and does not
contain real user data or credentials.
9. Reproduction Methodology
The reproduction procedure is designed only for the local laboratory.
Step 1 — Start the vulnerable container
docker compose up --build
Step 2 — Verify the service
Confirm that the PocketBase service used for the component-level laboratory is responding locally.
Step 3 — Execute the controlled reproduction script
The reproduction script will send the relevant request to the local vulnerable instance.
Example:
python exploit/reproduce.py
Step 4 — Observe the response
The response should demonstrate whether the application accepts the unauthenticated administrator creation request.
Step 5 — Verify the resulting state
The lab should verify whether an administrator account was created.
No external target should ever be used.
10. Detection
Detection should identify indicators associated with unauthorized administrator creation attempts.
Potential indicators include:
Requests to administrator creation functionality
Unauthenticated requests to administrative endpoints
Unexpected creation of a first administrator account
HTTP requests originating from an unexpected client
Repeated administrator creation attempts
Administrative account creation immediately after application initialization
The detection script is located in:
detection/detect.py
11. Remediation
The primary remediation is to upgrade Webhood to the fixed version:
Webhood 0.9.1
The vulnerable release should not be used in production.
A documented workaround is to restrict access to the affected administrator API functionality where an upgrade cannot immediately be performed.
After remediation:
Stop the vulnerable container.
Replace the vulnerable version with the fixed version.
Rebuild the container.
Start the patched environment.
Repeat the reproduction attempt.
Confirm that the vulnerable behavior is no longer possible.
Review application logs for unexpected administrative requests.
12. Remediation and Verification
The official Webhood fix for CVE-2024-31218 was verified using the actual Webhood `v0.9.1` source release.
The fixing commit is:
`735e7fa2814edeec9a2c07778ed51b3c018609f9`
The fix adds the migration:
`src/backend/migrations/1712252550_generate_random_admin.js`
The migration checks whether an administrator already exists. If no administrator exists, it creates an administrator account with a randomly generated password. This prevents an unauthenticated requester from claiming the first administrator through the exposed `/api/admins` endpoint.
#### Verification procedure