ChronoFrame: Missing authentication in setup wizard API allows reconfiguration

Summary

ChronoFrame through 1.0.0 lets unauthenticated attackers call the setup wizard API on an instance that is already configured. By POSTing to /api/wizard/storage, an attacker can activate an attacker-controlled S3 or OpenList storage provider, which redirects uploads and storage reads, and can overwrite site and map settings. The attack needs only network access to the web application and no login, so internet-facing instances are most at risk.

Affected

• HoshinoSuzumi ChronoFrame versions 0 to 1.0.0 (inclusive), according to the CNA record
• Docker images tagged latest or v1.0.0 are the documented deployment routes
• Exact affected commits: Unknown.

Fixed in

Unknown. No fixed version or vendor advisory was found at the time of research.

Workaround

• Block or restrict access to /api/wizard/ at the reverse proxy or firewall so that only administrators on a management network can reach it
• Place the instance behind a VPN, SSO or an access proxy
• Review the storage provider, S3 endpoint and bucket, site settings and map settings for unexpected changes

Exploitation

• CISA SSVC (per CVE record): Exploitation: poc, Automatable: yes, Technical Impact: partial
• A public researcher write-up exists; its content was not verified
• No public proof-of-concept code was found in the research and no in-the-wild exploitation is known. This is not evidence of absence.

Our recommendation

• Inventory all ChronoFrame and fork instances across clients, including the Docker image version
• Restrict /api/wizard/ and admin paths on internet-facing instances now
• Review storage and site settings and S3 or OpenList credentials for signs of tampering; rotate credentials if tampering is suspected
• Do not expose the instance publicly without access control
• Monitor the upstream repository and the NVD/CISA record for a fix, and update as soon as one is released

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record references: GitHub repository github.com
• Vulnerable code: server/api/wizard/storage.post.ts at v1.0.0 github.com
• VulnCheck advisory www.vulncheck.com
• Researcher write-up (HackMD) hackmd.io
• Vulners / MEND record vulners.com
• Strix CVE record www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:58.