Summary

The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms.
An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks.

Compromise Chain: Unauthenticated to Full Root Access

This issue is part of a full compromise chain allowing an unauthenticated user to gain root access on the Reachy’s operating system:

1. Unrestricted File Upload in Media Sounds Upload API <= current finding
2. Bluetooth Authentication Bypass
3. Bluetooth Directory Traversal

Description

The root cause of the issue is at the handler located in “src/daemon/app/routers/media.py” file at the “upload_sound” method:

@router.post("/sounds/upload")
async def upload_sound(
    file: UploadFile = File(...),
) -> dict[str, str]:
    """Upload a sound file to the daemon's temporary sound directory.
    The file is saved to ``/tmp/reachy_mini_sounds/<original_filename>``.
    If a file with the same name already exists it is overwritten.
    Returns:
        JSON with the absolute *path* of the saved file on the daemon.
    """
    if not file.filename:
        raise HTTPException(status_code=400, detail="Filename is required")
    # Reject path traversal
    filename = Path(file.filename).name
    if not filename or filename in (".", ".."):
        raise HTTPException(status_code=400, detail="Invalid filename")
    os.makedirs(SOUNDS_TMP_DIR, exist_ok=True)
    dest = os.path.join(SOUNDS_TMP_DIR, filename)
    content = await file.read()
    with open(dest, "wb") as f:
        f.write(content)
    return {"status": "ok", "path": dest}

This endpoint lacks multiple defence mechanisms:

1. No authentication mechanism.
2. No file extension validation.
3. No file content/size validation.

Additionally, the daemon is bound to the 0.0.0.0 network interfaces (a.k.a. all network interfaces) by default along with permissive CORS ( allow_origins=[“*”] ) meaning the following API endpoint is exposed to every network interface the daemon is connected to.

PoC

1. Start the daemon in simulation mode (command depends on the installed environment):