GHSA-28f5-38xr-jh2w

Suggest an improvement
Source
https://github.com/advisories/GHSA-28f5-38xr-jh2w
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-28f5-38xr-jh2w/GHSA-28f5-38xr-jh2w.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-28f5-38xr-jh2w
Aliases
Published
2026-07-28T14:26:53Z
Modified
2026-07-28T14:30:38.088075287Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CVSS Calculator
Summary
java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor
Details

Summary

When directConnect(true) is enabled, appium/java-client unconditionally accepts directConnectHost, directConnectPort, and directConnectPath from the server's NEW_SESSION response and silently redirects all subsequent session traffic to the attacker-specified endpoint — with no allowlist, no host validation, and no user notification.

Affected Code

  • AppiumCommandExecutor.java (line 196–219): setDirectConnect() builds a new URL from server-supplied fields and calls overrideServerUrl(newUrl) without validating host/IP.
  • DirectConnect.java: getUrl() constructs protocol://host:port/path with no allowlist.

Root Cause

Only the protocol is validated (must equal "https"). The destination host and port are never checked against any allowlist or denylist.

PoC (confirmed)

A rogue server injecting directConnectHost=127.0.0.1:4443 causes the client to silently redirect all post-session commands:

[bootstrap] POST /wd/hub/session [bootstrap] Injecting directConnect -> https://127.0.0.1:4443/wd/hub [redirect-target] HIT #1: GET /wd/hub/session/poc-session-001/source [redirect-target] HIT #2: DELETE /wd/hub/session/poc-session-001

Original source code unmodified — confirmed via git diff HEAD (empty).

Evidence Screenshots

Screenshot 1 — Rogue server capturing redirected traffic:

<img width="887" height="146" alt="1" src="https://github.com/user-attachments/assets/cc28002c-ea20-4ac8-8336-cec632e3c842" />

Screenshot 2 — Java client processing response from attacker host:

<img width="788" height="130" alt="2" src="https://github.com/user-attachments/assets/222cbab0-0d53-45b2-847d-6aa4e3b79370" />

Impact

  • Full interception of session traffic
  • Network pivot to internal hosts (RFC-1918, 169.254.169.254)
  • Cloud credential theft via IMDS endpoint
  • Escalates to ~8.1 High in CI/CD environments where directConnect(true) is set in shared base configuration

Suggested Fix

Add allowlist validation before overrideServerUrl() is called, and/or block RFC-1918/loopback/link-local destinations by default.

pocappiumdirectconnect.zip

Database specific 
{
    "cwe_ids": [
        "CWE-441",
        "CWE-918"
    ],
    "github_reviewed_at": "2026-07-28T14:26:53Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": null
}
References

Affected packages

Maven / io.appium:java-client

Package

Name
io.appium:java-client
View open source insights on deps.dev
Purl
pkg:maven/io.appium/java-client

Affected ranges

Type
ECOSYSTEM
Events
Introduced
8.2.1
Fixed
10.1.1

Affected versions

8.*
8.2.1
8.3.0
8.4.0
8.5.0
8.5.1
8.6.0
9.*
9.0.0
9.1.0
9.2.0
9.2.1
9.2.2
9.2.3
9.3.0
9.4.0
9.5.0
10.*
10.0.0
10.1.0

Database specific

last_known_affected_version_range 
"<= 10.1.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-28f5-38xr-jh2w/GHSA-28f5-38xr-jh2w.json"