Tag: RCE

The Anatomy Table of muse2api: A Self-Update RCE Chain, an XSS in Dual Contexts, and the Evidence-Chain Verdict on Whether a Clean IP Can Cure a 403

A full static review of muse2api (923 stars, wrapping muse.ai into an OpenAI-compatible API) returns a two-temperature verdict: code trustworthiness above average (near-textbook SSRF protection, no fallback to direct connection on proxy failure, status semantics that never inflate), but two structural wounds — the admin update endpoint overwrites its own code with git checkout -f origin/main and os._exit-restarts, making any push to main a remote-code-execution on every deployment node that clicks upgrade, and the admin page carries a stored XSS through onclick string concatenation, where HTML-entity escaping fails in the dual context of a JS string inside an attribute. And the question of whether a clean IP can cure a 403 was judged by a field-tested evidence chain: credential-less requests return 401 even through a Japanese VPN exit (the IP layer is not blocking), the 403 arrives only with a cookie as a session-layer verdict, and in the same-day ban wave accounts that kept the same IP were banned anyway — changing IP cannot cure a flagged account, and repeated IP churn accelerates the flagging.