🛡️ Mythoops — Adversarial Security Review #
ℹ️ Informational notes only.
Round 0 · model parallel (4/7 models) · ⚪ 8 info
- Repository:
xm7cjmu7j2is@master
- File:
appview/state/manifest.go:21
- Found by:
zai-org/GLM-4.6
- Date found: 2026-06-25
Attack chain: 1. Attacker sends a request to /manifest.json with a malicious Host header. 2. The manifest generation code uses the Host header to construct the 'start_url' and 'id' fields. 3. The browser interprets the manifest and may fetch icons from the attacker-controlled domain.
The PWA manifest generation uses a static 'start_url' and 'id' fields, but the 'icons' array is dynamically constructed from a hardcoded list of sizes. If an attacker can control the Host header, they could influence the base URL for icon paths, leading to potential path injection or serving malicious icons.
Data flow: Host Header → manifest.go:21 (start_url/id) → manifest.go:21 (icons array) → HTTP Response (manifest.json)
Preconditions: Attacker must be able to control the Host header in the request to the manifest endpoint.
Exploit: An attacker crafts a request with a malicious Host header (e.g., 'evil.com') to the /manifest.json endpoint. The generated manifest will include icon URLs like 'https://evil.com/static/pwa-icons/android/144.png', potentially causing the browser to fetch icons from an attacker-controlled domain.
⚙ Exploit demonstration:
GET /manifest.json HTTP/1.1\nHost: evil.com\n\n
Fix: Ensure that the 'start_url' and 'id' fields in the manifest are not derived from untrusted input like the Host header. Use a hardcoded base URL or validate the Host header against a whitelist.
confidence 85% · exploitability 5%
⚪ INFO — Static File Path Disclosure via Predictable Icon Paths (CWE-200) #
- Repository:
xm7cjmu7j2is@master
- File:
appview/state/manifest.go:21-30
- Found by:
zai-org/GLM-4.6
- Date found: 2026-06-25
Attack chain: 1. Attacker requests /manifest.webmanifest. 2. Server responds with dynamically generated icon paths. 3. Attacker enumerates sizes to infer file existence. 4. Attacker gains knowledge of internal file structure.
The manifest dynamically generates icon paths using a predictable pattern (/static/pwa-icons/android/{size}.png). An attacker can enumerate sizes to confirm the existence of specific icon files, potentially revealing internal file structure or versioning details.
Data flow: appview/state/manifest.go:21 (manifestIcons function) → appview/state/manifest.go:28 (path construction) → HTTP response (manifest endpoint)
Preconditions: Attacker can access the manifest endpoint (/manifest.webmanifest). The static files must exist at the predicted paths.
Exploit: An attacker iterates through common icon sizes (e.g., 144, 192, 512) by requesting the manifest and observing the generated paths. If a size is not in the predefined list, the absence of a path may indicate missing files, while presence confirms the file structure.
⚙ Exploit demonstration:
GET /manifest.webmanifest HTTP/1.1\nHost: tangled.org\n\n# Parse response to extract icon paths and test for additional sizes like 128, 256, 384, etc.
Fix: Avoid exposing predictable file paths in the manifest. Use a whitelist of allowed sizes or obfuscate paths. Consider serving icons through a controller that validates access.
confidence 85% · exploitability 5%
- Repository:
xm7cjmu7j2is@master
- File:
appview/state/manifest.go:20
- Found by:
zai-org/GLM-4.6
- Date found: 2026-06-25
Attack chain: 1. Attacker requests manifest in non-production environment. 2. Server responds with hardcoded production URL. 3. Attacker learns production domain.
The manifest hardcodes the base URL as 'https://tangled.org', which may expose internal configuration or deployment details if the app is run in a different environment (e.g., staging, localhost).
Data flow: appview/state/manifest.go:20 (hardcoded URL) → HTTP response (manifest endpoint)
Preconditions: App is deployed in an environment where the hardcoded URL does not match the actual base URL (e.g., internal testing).
Exploit: An attacker accesses the manifest in a non-production environment and observes the hardcoded 'https://tangled.org', revealing the production domain.
⚙ Exploit demonstration:
GET /manifest.webmanifest HTTP/1.1\nHost: staging.tangled.org\n\n# Response contains 'id': 'https://tangled.org', leaking production domain.
Fix: Dynamically generate the base URL based on the request's Host header or a configuration variable. Avoid hardcoding production URLs.
confidence 85% · exploitability 5%
⚪ INFO — Static Icon Paths in PWA Manifest (CWE-200) #
- Repository:
xm7cjmu7j2is@master
- File:
appview/state/manifest.go:10-20
- Found by:
deepseek-ai/DeepSeek-V3.1
- Date found: 2026-06-25
The manifest now references static PNG icons under '/static/pwa-icons/android/'. While not a vulnerability, this change introduces new static assets that should be served securely without path traversal risks.
Data flow: appview/state/manifest.go:15 → manifest.json → browser request for icons
Preconditions: The static file handler must be properly configured to prevent directory traversal.
Exploit: If the static file handler is misconfigured, an attacker might attempt path traversal to access sensitive files.
⚙ Exploit demonstration:
GET /static/pwa-icons/android/../../../etc/passwd
Fix: Ensure the static file server is rooted correctly and rejects path traversal attempts.
confidence 90% · exploitability 0%
⚪ INFO — Potential PWA Icon Path Traversal via Malicious Manifest Generation (CWE-22) #
- Repository:
xm7cjmu7j2is@master
- File:
appview/state/manifest.go:21-31
- Found by:
deepseek-ai/DeepSeek-V3.1
- Date found: 2026-06-25
The manifestIcons() function dynamically constructs icon paths using string concatenation with user-controlled size values. While the sizes are currently hardcoded, if future changes allow user input to influence the size parameter, it could lead to path traversal attacks where an attacker accesses arbitrary files.
Data flow: User input → manifestIcons() size parameter → file path construction → icon URL in manifest → client request for icon
Preconditions: The size parameter must become user-controllable (e.g., via query parameter or configuration) instead of being hardcoded.
Exploit: An attacker modifies the size parameter to include path traversal sequences (e.g., '../../../etc/passwd'), causing the manifest to reference a sensitive file. When the PWA loads, it attempts to fetch the malicious icon path, potentially exposing file contents.
⚙ Exploit demonstration:
If size parameter was user-controlled: GET /manifest.webapp?size=../../../etc/passwd
Fix: Validate the size parameter against a whitelist of allowed values if it becomes dynamic. Use filepath.Join() to safely construct paths.
confidence 90% · exploitability 0%
- Repository:
xm7cjmu7j2is@master
- File:
appview/state/manifest.go:21
- Found by:
deepseek-ai/DeepSeek-V3.1
- Date found: 2026-06-25
The manifest's 'start_url' and 'id' fields are hardcoded to 'https://tangled.org', but if the application uses the Host header to generate these fields dynamically in a different context, it could lead to open redirect or PWA scope confusion. While the current code is safe, the structure suggests potential for injection if dynamic values are introduced.
Data flow: HTTP Host header → appview/state/manifest.go:21 → manifest.json
Preconditions: The application must be modified to use dynamic values (like Host header) for 'start_url' or 'id' fields without proper validation.
Exploit: An attacker could manipulate the Host header to point to a malicious domain, causing the PWA to be installed with a compromised scope or start URL.
⚙ Exploit demonstration:
GET /manifest.json HTTP/1.1
Host: evil.com
Fix: Keep the 'start_url' and 'id' fields hardcoded to the canonical domain. If dynamic values are ever needed, validate them against an allowlist.
confidence 90% · exploitability 0%
⚪ INFO — PWA Manifest Icon Path Hardcoded to Android-Only Icons (CWE-1106) #
- Repository:
xm7cjmu7j2is@master
- File:
appview/state/manifest.go:21-31
- Found by:
deepseek-ai/DeepSeek-V3.1
- Date found: 2026-06-25
The manifestIcons() function only returns Android-specific icon sizes (144, 192, 512) and ignores iOS-specific icons that were added in the same commit. This may cause PWA icons to display incorrectly on iOS devices that expect different sizes.
Data flow: manifest.go:21 → manifest.go:25 → manifest.go:10 (manifestData)
Preconditions: User accesses the PWA from an iOS device that requires different icon sizes
Exploit: An iOS user adds the PWA to their home screen but receives suboptimal icon rendering due to missing iOS-specific icon sizes in the manifest.
⚙ Exploit demonstration:
Access https://tangled.org/manifest.json from an iOS device and observe the icons array only contains Android-specific sizes.
Fix: Include iOS-specific icon sizes (152, 167, 180) in the manifestIcons() function alongside the Android sizes.
confidence 70% · exploitability 0%
⚪ INFO — Inconsistent PWA Icon Implementation (CWE-1105) #
- Repository:
xm7cjmu7j2is@master
- File:
appview/pages/templates/layouts/base.html:27-29
- Found by:
deepseek-ai/DeepSeek-V3.1
- Date found: 2026-06-25
The base.html template now includes multiple apple-touch-icon link tags for iOS, but the manifest only references Android icons. This creates inconsistency between what's declared in the HTML head and what's available in the web app manifest.
Data flow: base.html:27 → base.html:29 → browser rendering
Preconditions: User accesses the application from a PWA-supporting browser
Exploit: Browser behavior may be inconsistent when resolving PWA icons between the manifest declaration and HTML head links.
⚙ Exploit demonstration:
Inspect the HTML head and manifest.json to observe the icon declaration mismatch.
Fix: Ensure manifest icons and HTML head icon declarations are consistent across platforms.
confidence 70% · exploitability 0%
Generated by Mythoops 0.1 — red-team AI PR review. Findings are model-generated; verify before acting.
eti.tf