Outray cli is vulnerable to race conditions in tunnels creation
Summary
A TOCTOU race condition vulnerability allows a user to exceed the set number of active tunnels in their subscription plan.
Details
Affected conponent: apps/web/src/routes/api/tunnel/register.ts
/tunnel/register endpoint code-:
```ts
// Check if tunnel already exists in database
const [existingTunnel] = await db
.select()
.from(tunnels)
.where(eq(tunnels.url, tunnelUrl));
const isReconnection = !!existingTunnel;
console.log(
[TUNNEL LIMIT CHECK] Org: ${organizationId}, Tunnel: ${tunnelId},
);
console.log(
[TUNNEL LIMIT CHECK] Is Reconnection: ${isReconnection},
);
console.log(
[TUNNEL LIMIT CHECK] Plan: ${currentPlan}, Limit: ${tunnelLimit},
);
// Check limits only for NEW tunnels (not reconnections)
if (!isReconnection) {
// Count active tunnels from Redis SET
const activeCount = await redis.scard(setKey);
console.log(
[TUNNEL LIMIT CHECK] Active count in Redis: ${activeCount},
);
// The current tunnel is NOT yet in the online_tunnels set (added after successful registration)
// So we check if activeCount >= limit (not >)
if (activeCount >= tunnelLimit) {
console.log(
[TUNNEL LIMIT CHECK] REJECTED - ${activeCount} >= ${tunnelLimit},
);
return json(
{
error: Tunnel limit reached. The ${currentPlan} plan allows ${tunnelLimit} active tunnel${tunnelLimit > 1 ? "s" : ""}.,
},
{ status: 403 },
);
}
console.log(
[TUNNEL LIMIT CHECK] ALLOWED - ${activeCount} < ${tunnelLimit},
);
} else {
console.log([TUNNEL LIMIT CHECK] SKIPPED - Reconnection detected);
}
if (existingTunnel) {
// Tunnel with this URL already exists, update lastSeenAt
await db
.update(tunnels)
.set({ lastSeenAt: new Date() })
.where(eq(tunnels.id, existingTunnel.id));
return json({
success: true,
tunnelId: existingTunnel.id,
});
}
// Create new tunnel record
const tunnelRecord = {
id: randomUUID(),
url: tunnelUrl,
userId,
organizationId,
name: name || null,
protocol,
remotePort: remotePort || null,
lastSeenAt: new Date(),
createdAt: new Date(),
updatedAt: new Date(),
};
await db.insert(tunnels).values(tunnelRecord);
return json({ success: true, tunnelId: tunnelRecord.id });
} catch (error) {
console.error("Tunnel registration error:", error);
return json({ error: "Internal server error" }, { status: 500 });
}
```
- It checks if the tunnel exists in the database.
```ts
// Check if tunnel already exists in database
const [existingTunnel] = await db
.select()
.from(tunnels)
.where(eq(tunnels.url, tunnelUrl));
const isReconnection = !!existingTunnel;
```
```ts
// Check limits only for NEW tunnels (not reconnections)
if (!isReconnection) {
// Count active tunnels from Redis SET
const activeCount = await redis.scard(setKey);
console.log(
[TUNNEL LIMIT CHECK] Active count in Redis: ${activeCount},
);
```
- Redis is checked for existing tunnel to check for reconnection.
```ts
// Check limits only for NEW tunnels (not reconnections)
if (!isReconnection) {
// Count active tunnels from Redis SET
const activeCount = await redis.scard(setKey);
console.log(
[TUNNEL LIMIT CHECK] Active count in Redis: ${activeCount},
);
```
- If the tunnel limit is exceeded, it pops up the tunnel limit error.
```ts
if (activeCount >= tunnelLimit) {
console.log(
[TUNNEL LIMIT CHECK] REJECTED - ${activeCount} >= ${tunnelLimit},
);
return json(
{
error: Tunnel limit reached. The ${currentPlan} plan allows ${tunnelLimit} active tunnel${tunnelLimit > 1 ? "s" : ""}.,
},
{ status: 403 },
);
```
- If the limit is not exceeded, it triggers a the
Insert Statement without locking transactions from other request
```ts
await db.insert(tunnels).values(tunnelRecord);
```
- If parallel requests are made by the
wshandler in /outray/outray-main/apps/tunnel/src/core/WSHandler.ts from the command line app. A request can work on a non updated row because th
