[CRITICAL] Arbitrary TCP Connection Abuse - CVE-HSYNC-2026-002

[luthien-m]

Security Vulnerability Report

Severity: CRITICAL (CVSS 9.1)
File: lib/socket-relays.js

Description

The connectSocket function allows remote peers to establish arbitrary TCP connections to any host/port combination without authentication or validation. The whitelist/blacklist functionality is implemented but not enforced (TODO comment).

Vulnerable Code

//  TODO: check white and black lists on peer
socket.connect(relay.targetPort, relay.targetHost, () => {

Impact

• Internal network scanning
• SSRF attacks
• Lateral movement
• Access to internal services

Recommendation

Implement and enforce whitelist/blacklist validation, add authentication checks, and restrict target destinations.

References

• Found during security audit of hsync reverse proxy
• Part of comprehensive security review identifying 13 vulnerabilities