Hoppscotch
Unauthenticated Mass Assignment on Onboarding Endpoint Allows JWT Secret Injection and Full Server Takeover
An unauthenticated attacker can inject arbitrary configuration keys, including JWT_SECRET and SESSION_SECRET, into a fresh Hoppscotch installation through the POST /v1/onboarding/config endpoint, enabling complete server compromise. Self-hosted instances are most vulnerable during initial deployment when exposed to the internet before onboarding completion.
Four independent weaknesses enable this attack:
Weakness 1 Missing whitelist: true on ValidationPipe
Extra properties not declared in the SaveOnboardingConfigRequest DTO pass through to the service layer instead of being stripped.
Weakness 2 Unconstrained key iteration
The service uses Object.entries(dto) with a TypeScript cast as InfraConfigEnum that performs no runtime validation of which keys are allowed.
Weakness 3 Silent validation fallthrough
The validateEnvValues method’s default: break case allows security-critical keys like JWT_SECRET to pass validation without explicit checks.
Weakness 4 Unauthenticated endpoint access
The onboarding controller requires no authentication, only rate-limiting, and is accessible during fresh installs when usersCount === 0.
Attack precondition: fresh installation where onboarding is incomplete, or database state where usersCount === 0.
Step 1 Verify onboarding status
Step 2 Inject malicious configuration
Step 3 Verify compromise
Full server compromise enabling:
JWT forgery · Attacker creates valid tokens for any user, including administrators.
Complete data access · Authenticated queries expose all workspaces, collections, and team information.
Persistent access · Control of signing keys survives credential resets.
Additional injection vectors · Attacker can overwrite SESSION_SECRET, SESSION_COOKIE_NAME, RATE_LIMIT_TTL, RATE_LIMIT_MAX, ALLOW_SECURE_COOKIES, TOKEN_SALT_COMPLEXITY, GOOGLE_CLIENT_SECRET, GITHUB_CLIENT_SECRET, MICROSOFT_CLIENT_SECRET, and other security-critical flags.
Primary fix · Enable strict input validation in main.ts:
Defence in depth: implement an allowlist of keys permitted during onboarding; add explicit rejection cases for security-critical configuration keys; protect the endpoint with a one-time setup token (similar to GitLab/Grafana patterns).
Patched in GHSA-j542-4rch-8hwf ↗. Hoppscotch v2026.5.0 enables strict ValidationPipe options and removes mass-assignment on the onboarding route. Reporter: infycore · Analysis tool: agent-kira (Offgrid Security) · Published 2026-05-28.