---

## 脆弱性の詳細

### 2つのWebSocketエンドポイント

Marimoのサーバーは、さまざまな機能のために複数のWebSocketエンドポイントを実装しています。2つの主要なエンドポイント間の重要な違いは、認証チェックの有無です。```
  Authentication Flow Comparison:

  /ws (Notebook WebSocket):
  ┌─────────┐    ┌───────────────┐    ┌──────────┐    ┌───────────┐
  │ Connect │───>│ validate_auth │───>│  Accept  │───>│ Notebook  │
  └─────────┘    └───────┬───────┘    └──────────┘    └───────────┘
                         │
                    ❌ Reject if
                    not authenticated

  /terminal/ws (Terminal WebSocket):
  ┌─────────┐    ┌───────────────┐    ┌──────────┐    ┌───────────┐
  │ Connect │───>│ Check mode &  │───>│  Accept  │───>│ PTY Shell │
  └─────────┘    │ platform only │    └──────────┘    └───────────┘
                 └───────────────┘
                 ⚠️ No auth check!
                 Anyone gets a shell!

これは **CWE-306: 重要な機能に対する認証の欠如** です。サーバー上で最も危険なエンドポイント（対話型シェルを提供するもの）には、認証が一切ありません。

### 攻撃: 3分でAWSキーに到達するアドバイザリ

この悪用のタイムラインは、現代の脅威アクターがどれほど迅速に行動するかを示しています。```
  ┌──────────────────────────────────────────────────────────────┐
  │                   CVE-2026-39987 Timeline                    │
  ├──────────────────────────────────────────────────────────────┤
  │                                                              │
  │  T+0h        Advisory published                              │
  │  ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─                       │
  │  T+9h        First exploit built from advisory               │
  │  T+10h       Exploitation in the wild confirmed              │
  │  ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─                       │
  │  T+10h 0m    Attacker connects to /terminal/ws               │
  │  T+10h 1m    Full PTY shell obtained                         │
  │  T+10h 2m    .env file located and read                      │
  │  T+10h 3m    AWS keys exfiltrated                            │
  │              Total attack time: ~3 minutes                   │
  └──────────────────────────────────────────────────────────────┘

No exploit development needed. No shellcode. No memory corruption. Just a WebSocket client and a missing auth check.

---

## Impact Analysis

**Immediate impact on the Marimo host:**
- Full interactive shell with the privileges of the Marimo process
- Access to all files readable by the process (source code, data, credentials)
- Access to environment variables containing API keys and secrets
- Ability to execute arbitrary commands on the host system

**Credential exposure (the primary attack goal):**
- AWS access keys and secret keys from `.env` files or environment variables
- GCP/Azure service account credentials
- Database connection strings with passwords
- OpenAI, Anthropic, and other AI service API keys
- SSH keys and other authentication material

**Downstream impact (via stolen credentials):**
- Unauthorized access to cloud infrastructure (EC2, S3, Lambda, etc.)
- Data exfiltration from cloud storage and databases
- Resource abuse (cryptomining, AI API credit theft)
- Lateral movement into cloud and on-premise networks

**Risk amplification factors:**
- Notebook environments are designed to execute arbitrary code (that's their purpose)
- Data science environments typically have broad cloud access for training jobs
- Many Marimo instances are exposed to the internet for collaboration and remote work
- Security hardening is often an afterthought in research/experimentation environments

---

## Affected Versions

| Version | Status |
|---------|--------|
| Marimo 0.23.0+ | **Patched** |
| Marimo 0.20.5 to 0.22.x | **Likely vulnerable** (between advisory range and fix) |
| Marimo <= 0.20.4 | **Vulnerable** (confirmed range) |

---

## The Bigger Picture: AI/ML Toolchain Under Attack

CVE-2026-39987 is not an isolated incident. It's part of a clear pattern that emerged in April 2026:

| CVE | Product | Type | Status |
|:---|:---|:---|:---|
| **CVE-2026-39987** | Marimo | Pre-Auth RCE (WebSocket) | Exploited in 10 hours |
| **CVE-2026-33017** | Langflow | RCE | CISA KEV (March 26) |
| **CVE-2026-5059** | aws-mcp-server | Command Injection RCE | Public advisory |
| **TorchGeo** | TorchGeo | eval() RCE | Public advisory |

Four AI/ML development tools hit with critical RCE vulnerabilities in a single month. The AI/ML development pipeline is becoming the new shadow IT: tools deployed with broad access, minimal security oversight, and rich credential stores.```
  ┌─────────────────────────────────────────────────┐
  │        Why AI/ML Tools Are Prime Targets        │
  ├─────────────────────────────────────────────────┤
  │                                                 │
  │  1. DESIGNED to execute arbitrary code          │
  │     (that's literally what notebooks do)        │
  │                                                 │
  │  2. Run with elevated privileges                │
  │     (GPU access, cloud SDKs, network access)    │
  │                                                 │
  │  3. Contain high-value credentials              │
  │     (AWS keys, API tokens, DB connections)      │
  │                                                 │
  │  4. Often exposed to the network                │
  │     (for collaboration and remote access)       │
  │                                                 │
  │  5. Security hardening is an afterthought       │
  │     (focus on features and UX, not security)    │
  │                                                 │
  │  6. Users are researchers, not security experts │
  │     (default configs, weak passwords, no VPN)   │
  └─────────────────────────────────────────────────┘

**オプション:**

| フラグ | 説明 | デフォルト |
|------|-------------|---------|
| `-t`, `--target` | 単一のターゲットURL（例: `http://host:2718`） | — |
| `-f`, `--file` | ターゲットURLを1行に1つずつ含むファイル（`#`コメント対応） | — |
| `-o`, `--output` | 結果をJSONファイルに保存 | — |
| `--timeout` | 接続タイムアウト（秒） | `10` |
| `--verify-ssl` | SSL証明書の検証を有効化 | 無効 |
| `-v`, `--verbose` | 詳細情報を含む冗長出力 | オフ |

**出力例:**```
[*] CVE-2026-39987 Marimo Pre-Auth RCE Scanner
[*] Scanning 1 target(s)...
[*] NOTE: This scanner only checks for endpoint exposure.
[*]       No commands are executed on target systems.

======================================================================
Target: http://10.0.0.5:2718
Scan Time: 2026-04-14T16:00:00Z
Risk Level: CRITICAL
======================================================================
  Is Marimo:             YES
  Marimo Version:        0.19.2
  /terminal/ws Open:     YES — UNAUTHENTICATED
  Vulnerable:            YES

  *** CRITICAL: Pre-authenticated RCE is possible! ***
  *** An attacker can get a full PTY shell without any auth ***

  Details:
    - Marimo instance detected via /api/status
    - Marimo version: 0.19.2
    - WebSocket upgrade accepted — /terminal/ws accessible WITHOUT auth
    - CONFIRMED: /terminal/ws accepts unauthenticated connections while
      /ws requires auth — classic CVE-2026-39987 signature
    - Version 0.19.2 <= 0.20.4 — VULNERABLE to pre-auth RCE

======================================================================
[*] Scan Complete: 1 targets scanned
[*] Marimo Instances: 1 | Vulnerable: 1 | Critical: 1
======================================================================

**Nmap出力の例:**```
PORT     STATE SERVICE
2718/tcp open  http
| CVE-2026-39987_Marimo_RCE:
|   VULNERABLE:
|   Marimo Pre-Auth RCE (CVE-2026-39987)
|     State: VULNERABLE
|     Risk level: CRITICAL
|     Marimo Version: 0.19.2
|     /terminal/ws: accessible without authentication
|     Description:
|       The Marimo /terminal/ws WebSocket endpoint accepts connections
|       without authentication, enabling pre-authenticated RCE.
|       An attacker can obtain a full PTY shell without any credentials.
|     References:
|_      https://nvd.nist.gov/vuln/detail/CVE-2026-39987

`/terminal/ws` が 101 を返し、`/ws` が 401/403 を返す場合、これは典型的な CVE-2026-39987 のシグネチャです。

---

## 侵害の指標

環境内で以下の兆候に注意してください:

| 指標 | 確認場所 | 確認すべき内容 |
|:---|:---|:---|
| 不正な WebSocket 接続 | サーバー/プロキシログ | 予期しない IP からの `/terminal/ws` への接続 |
| PTY セッションの作成 | プロセス監視 | Marimo サーバーによって生成された予期しないシェルプロセス |
| ファイルアクセス | ファイル監査ログ | `.env`、資格情報ファイル、または SSH キーの読み取り |
| 資格情報の使用 | クラウドプロバイダーの監査ログ | Marimo 環境に保存されていたキーを使用した API 呼び出し |
| 外部へのデータ転送 | ネットワーク監視 | Marimo ホストからの異常な送信トラフィック |

**調査コマンド:**```bash
# Check for active WebSocket connections
ss -tnp | grep <MARIMO_PORT>

# Review process tree for unexpected shells
ps aux --forest | grep -A5 marimo

# Check if .env or credential files were recently accessed
stat .env
stat ~/.aws/credentials

# Review cloud provider activity logs for unauthorized access
aws cloudtrail lookup-events --lookup-attributes AttributeKey=AccessKeyId,AttributeValue=<KEY_ID>

# Check for unauthorized outbound connections
netstat -tnp | grep ESTABLISHED | grep -v 127.0.0.1