[GH-ISSUE #4928] [bug]: High usage of CPU #1859

New issue

Closed

opened 2026-03-16 22:08:32 +03:00 by kerem · 1 comment

kerem commented

2026-03-16 22:08:32 +03:00

Owner

Originally created by @bcortezf on GitHub (Mar 21, 2025).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/4928

Is there an existing issue for this?

I have searched existing issues and this bug hasn't been reported yet

Current behavior

I have recently installed Hoppscotch on my server, and yesterday I noticed that a malware (Kingsin) got installed into my hoppscotch db container (postgres:15).

I noticed a high usage of cpu on the database container (1540%). So i checked the logs and notice that some files were downloaded. The details are in the Logs and screenshots section

For some reason, someone was able to spread a malware (kinsing) on the hoppscotch_db container. How? I dont know.
It was because of hoppscotch image or backend? I don't know.

Also, in my ISP's modem, the only ports I have opened are 80 and 443.

Server: Ubuntu 24.04.2 LTS (GNU/Linux 6.8.0-55-generic x86_64)
Docker: Docker version 28.0.2, build 0442a73
Nginx: nginx version: nginx/1.24.0 (Ubuntu)

Has someone else experienced something similar?

docker-compose.yml

version: '3.8'

services:
  hoppscotch-db:
    image: postgres:15
    ports:
      - "5432:5432"
    user: postgres
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: testpass
      POSTGRES_DB: hoppscotch
    volumes:
      - hoppscotch_db_data:/var/lib/postgresql/data
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "sh -c 'pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}'"
        ]
      interval: 5s
      timeout: 5s
      retries: 10
    networks:
      - hoppscotch-network
  hoppscotch:
    image: hoppscotch/hoppscotch
    env_file:
      - .env
    depends_on:
      hoppscotch-db:
        condition: service_healthy
    ports:
      - "3000:80"
    networks:
      - hoppscotch-network


networks:
  hoppscotch-network:
    driver: bridge
volumes:
  hoppscotch_db_data:

.env

#-----------------------Backend Config------------------------------#
# Prisma Config
DATABASE_URL=postgresql://postgres:testpass@hoppscotch-db:5432/hoppscotch

# Auth Tokens Config
JWT_SECRET=secret1233
TOKEN_SALT_COMPLEXITY=10
MAGIC_LINK_TOKEN_VALIDITY= 3
# Default validity is 7 days (604800000 ms) in ms
REFRESH_TOKEN_VALIDITY=604800000
# Default validity is 1 day (86400000 ms) in ms
ACCESS_TOKEN_VALIDITY=86400000
SESSION_SECRET=********
# Reccomended to be true, set to false if you are using http
# Note: Some auth providers may not support http requests
ALLOW_SECURE_COOKIES=true

# Sensitive Data Encryption Key while storing in Database (32 character)
DATA_ENCRYPTION_KEY=data encryption key with 32 char

# Hoppscotch App Domain Config
REDIRECT_URL=https://hoppscotch.******.**
# Whitelisted origins for the Hoppscotch App.
# This list controls which origins can interact with the app through cross-origin comms.
# - localhost ports (3170, 3000, 3100): app, backend, development servers and services
# - app://localhost_3200: Bundle server origin identifier
#   NOTE: `3200` here refers to the bundle server (port 3200) that provides the bundles,
#   NOT where the app runs. The app itself uses the `app://` protocol with dynamic
#   bundle names like `app://{bundle-name}/`
WHITELISTED_ORIGINS=https://hoppscotch.******.**,http://localhost:3100,app://localhost_3200,app://hoppscotch
VITE_ALLOWED_AUTH_PROVIDERS=GOOGLE,GITHUB,MICROSOFT,EMAIL

# Google Auth Config
GOOGLE_CLIENT_ID=************************************************
GOOGLE_CLIENT_SECRET=************************************************
GOOGLE_CALLBACK_URL=https://hoppscotch.******.**/backend/v1/auth/google/callback
GOOGLE_SCOPE=email,profile

# Github Auth Config
GITHUB_CLIENT_ID=***********************
GITHUB_CLIENT_SECRET=**********************************
GITHUB_CALLBACK_URL=https://hoppscotch.******.**/backend/v1/auth/github/callback
GITHUB_SCOPE=user:email

# Microsoft Auth Config
MICROSOFT_CLIENT_ID=************************************************
MICROSOFT_CLIENT_SECRET=************************************************
MICROSOFT_CALLBACK_URL=https://hoppscotch.******.**/backend/v1/auth/microsoft/callback
MICROSOFT_SCOPE=user.read
MICROSOFT_TENANT=common

# Mailer config
MAILER_SMTP_ENABLE=true
MAILER_USE_CUSTOM_CONFIGS=true
MAILER_ADDRESS_FROM=****@******.**

#MAILER_SMTP_URL=smtp://192.168.1.5:1025

# The following are used if custom mailer configs is true
MAILER_SMTP_HOST=smtp.google.com
MAILER_SMTP_PORT=587
MAILER_SMTP_SECURE=true
MAILER_SMTP_USER=**********@gmail.com
MAILER_SMTP_PASSWORD=******************
MAILER_TLS_REJECT_UNAUTHORIZED=false

# Rate Limit Config
RATE_LIMIT_TTL=60 # In seconds
RATE_LIMIT_MAX=100 # Max requests per IP


#-----------------------Frontend Config------------------------------#


# Base URLs
VITE_BASE_URL=https://hoppscotch.******.**
VITE_SHORTCODE_BASE_URL=https://hoppscotch.******.**
VITE_ADMIN_URL=https://hoppscotch.******.**/admin

# Backend URLs
VITE_BACKEND_GQL_URL=https://hoppscotch.******.**/backend/graphql
VITE_BACKEND_WS_URL=ws://hoppscotch.******.**/backend/graphql
VITE_BACKEND_API_URL=https://hoppscotch.******.**/backend/v1

# Terms Of Service And Privacy Policy Links (Optional)
VITE_APP_TOS_LINK=https://docs.hoppscotch.io/support/terms
VITE_APP_PRIVACY_POLICY_LINK=https://docs.hoppscotch.io/support/privacy

# Set to `true` for subpath based access
ENABLE_SUBPATH_BASED_ACCESS=true

ufw

--                         ------      ----
80/tcp                     ALLOW       Anywhere
443/tcp                    ALLOW       Anywhere
80/tcp (v6)                ALLOW       Anywhere (v6)
443/tcp (v6)               ALLOW       Anywhere (v6)

Steps to reproduce

N/A

Logs and Screenshots

hoppscotch-db_1  | md5sum: /tmp/kinsing: No such file or directory
hoppscotch-db_1  | /tmp/kinsing is not b3039abf2ad5202f4a9363b418002351, actual
hoppscotch-db_1  | chmod: cannot access '/tmp/kinsing': No such file or directory
hoppscotch-db_1  |   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
hoppscotch-db_1  |                                  Dload  Upload   Total   Spent    Left  Speed
100 5828k  100 5828k    0     0  2108k      0  0:00:02  0:00:02 --:--:-- 2108k
hoppscotch-db_1  | /tmp/kinsing is b3039abf2ad5202f4a9363b418002351
hoppscotch-db_1  | md5sum: /tmp/libsystem.so: No such file or directory
hoppscotch-db_1  | /tmp/libsystem.so is not ccef46c7edf9131ccffc47bd69eb743b, actual
hoppscotch-db_1  | chmod: cannot access '/tmp/libsystem.so': No such file or directory
hoppscotch-db_1  |   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
hoppscotch-db_1  |                                  Dload  Upload   Total   Spent    Left  Speed
100 26800  100 26800    0     0  32643      0 --:--:-- --:--:-- --:--:-- 32603
hoppscotch-db_1  | /tmp/libsystem.so is ccef46c7edf9131ccffc47bd69eb743b
hoppscotch-db_1  |   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
hoppscotch-db_1  |                                  Dload  Upload   Total   Spent

Environment

Production

Hoppscotch Version

Cloud

Interceptor

Not Applicable - Issue not related to network requests

Browsers Affected

No response

Operating System

None

Additional Information

No response

Originally created by @bcortezf on GitHub (Mar 21, 2025). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/4928 ### Is there an existing issue for this? - [x] I have searched existing issues and this bug hasn't been reported yet ### Current behavior I have recently installed Hoppscotch on my server, and yesterday I noticed that a malware (Kingsin) got installed into my hoppscotch db container (postgres:15). I noticed a high usage of cpu on the database container (1540%). So i checked the logs and notice that some files were downloaded. The details are in the Logs and screenshots section For some reason, someone was able to spread a malware (kinsing) on the hoppscotch_db container. How? I dont know. It was because of hoppscotch image or backend? I don't know. Also, in my ISP's modem, the only ports I have opened are 80 and 443. Server: `Ubuntu 24.04.2 LTS (GNU/Linux 6.8.0-55-generic x86_64)` Docker: `Docker version 28.0.2, build 0442a73` Nginx: `nginx version: nginx/1.24.0 (Ubuntu)` Has someone else experienced something similar? ## docker-compose.yml ```yml version: '3.8' services: hoppscotch-db: image: postgres:15 ports: - "5432:5432" user: postgres environment: POSTGRES_USER: postgres POSTGRES_PASSWORD: testpass POSTGRES_DB: hoppscotch volumes: - hoppscotch_db_data:/var/lib/postgresql/data healthcheck: test: [ "CMD-SHELL", "sh -c 'pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}'" ] interval: 5s timeout: 5s retries: 10 networks: - hoppscotch-network hoppscotch: image: hoppscotch/hoppscotch env_file: - .env depends_on: hoppscotch-db: condition: service_healthy ports: - "3000:80" networks: - hoppscotch-network networks: hoppscotch-network: driver: bridge volumes: hoppscotch_db_data: ``` ## .env ```env #-----------------------Backend Config------------------------------# # Prisma Config DATABASE_URL=postgresql://postgres:testpass@hoppscotch-db:5432/hoppscotch # Auth Tokens Config JWT_SECRET=secret1233 TOKEN_SALT_COMPLEXITY=10 MAGIC_LINK_TOKEN_VALIDITY= 3 # Default validity is 7 days (604800000 ms) in ms REFRESH_TOKEN_VALIDITY=604800000 # Default validity is 1 day (86400000 ms) in ms ACCESS_TOKEN_VALIDITY=86400000 SESSION_SECRET=******** # Reccomended to be true, set to false if you are using http # Note: Some auth providers may not support http requests ALLOW_SECURE_COOKIES=true # Sensitive Data Encryption Key while storing in Database (32 character) DATA_ENCRYPTION_KEY=data encryption key with 32 char # Hoppscotch App Domain Config REDIRECT_URL=https://hoppscotch.******.** # Whitelisted origins for the Hoppscotch App. # This list controls which origins can interact with the app through cross-origin comms. # - localhost ports (3170, 3000, 3100): app, backend, development servers and services # - app://localhost_3200: Bundle server origin identifier # NOTE: `3200` here refers to the bundle server (port 3200) that provides the bundles, # NOT where the app runs. The app itself uses the `app://` protocol with dynamic # bundle names like `app://{bundle-name}/` WHITELISTED_ORIGINS=https://hoppscotch.******.**,http://localhost:3100,app://localhost_3200,app://hoppscotch VITE_ALLOWED_AUTH_PROVIDERS=GOOGLE,GITHUB,MICROSOFT,EMAIL # Google Auth Config GOOGLE_CLIENT_ID=************************************************ GOOGLE_CLIENT_SECRET=************************************************ GOOGLE_CALLBACK_URL=https://hoppscotch.******.**/backend/v1/auth/google/callback GOOGLE_SCOPE=email,profile # Github Auth Config GITHUB_CLIENT_ID=*********************** GITHUB_CLIENT_SECRET=********************************** GITHUB_CALLBACK_URL=https://hoppscotch.******.**/backend/v1/auth/github/callback GITHUB_SCOPE=user:email # Microsoft Auth Config MICROSOFT_CLIENT_ID=************************************************ MICROSOFT_CLIENT_SECRET=************************************************ MICROSOFT_CALLBACK_URL=https://hoppscotch.******.**/backend/v1/auth/microsoft/callback MICROSOFT_SCOPE=user.read MICROSOFT_TENANT=common # Mailer config MAILER_SMTP_ENABLE=true MAILER_USE_CUSTOM_CONFIGS=true MAILER_ADDRESS_FROM=****@******.** #MAILER_SMTP_URL=smtp://192.168.1.5:1025 # The following are used if custom mailer configs is true MAILER_SMTP_HOST=smtp.google.com MAILER_SMTP_PORT=587 MAILER_SMTP_SECURE=true MAILER_SMTP_USER=**********@gmail.com MAILER_SMTP_PASSWORD=****************** MAILER_TLS_REJECT_UNAUTHORIZED=false # Rate Limit Config RATE_LIMIT_TTL=60 # In seconds RATE_LIMIT_MAX=100 # Max requests per IP #-----------------------Frontend Config------------------------------# # Base URLs VITE_BASE_URL=https://hoppscotch.******.** VITE_SHORTCODE_BASE_URL=https://hoppscotch.******.** VITE_ADMIN_URL=https://hoppscotch.******.**/admin # Backend URLs VITE_BACKEND_GQL_URL=https://hoppscotch.******.**/backend/graphql VITE_BACKEND_WS_URL=ws://hoppscotch.******.**/backend/graphql VITE_BACKEND_API_URL=https://hoppscotch.******.**/backend/v1 # Terms Of Service And Privacy Policy Links (Optional) VITE_APP_TOS_LINK=https://docs.hoppscotch.io/support/terms VITE_APP_PRIVACY_POLICY_LINK=https://docs.hoppscotch.io/support/privacy # Set to `true` for subpath based access ENABLE_SUBPATH_BASED_ACCESS=true ``` ## ufw ```ufw -- ------ ---- 80/tcp ALLOW Anywhere 443/tcp ALLOW Anywhere 80/tcp (v6) ALLOW Anywhere (v6) 443/tcp (v6) ALLOW Anywhere (v6) ``` ### Steps to reproduce N/A ### Logs and Screenshots ```shell hoppscotch-db_1 | md5sum: /tmp/kinsing: No such file or directory hoppscotch-db_1 | /tmp/kinsing is not b3039abf2ad5202f4a9363b418002351, actual hoppscotch-db_1 | chmod: cannot access '/tmp/kinsing': No such file or directory hoppscotch-db_1 | % Total % Received % Xferd Average Speed Time Time Time Current hoppscotch-db_1 | Dload Upload Total Spent Left Speed 100 5828k 100 5828k 0 0 2108k 0 0:00:02 0:00:02 --:--:-- 2108k hoppscotch-db_1 | /tmp/kinsing is b3039abf2ad5202f4a9363b418002351 hoppscotch-db_1 | md5sum: /tmp/libsystem.so: No such file or directory hoppscotch-db_1 | /tmp/libsystem.so is not ccef46c7edf9131ccffc47bd69eb743b, actual hoppscotch-db_1 | chmod: cannot access '/tmp/libsystem.so': No such file or directory hoppscotch-db_1 | % Total % Received % Xferd Average Speed Time Time Time Current hoppscotch-db_1 | Dload Upload Total Spent Left Speed 100 26800 100 26800 0 0 32643 0 --:--:-- --:--:-- --:--:-- 32603 hoppscotch-db_1 | /tmp/libsystem.so is ccef46c7edf9131ccffc47bd69eb743b hoppscotch-db_1 | % Total % Received % Xferd Average Speed Time Time Time Current hoppscotch-db_1 | Dload Upload Total Spent ``` ### Environment Production ### Hoppscotch Version Cloud ### Interceptor Not Applicable - Issue not related to network requests ### Browsers Affected _No response_ ### Operating System None ### Additional Information _No response_

kerem

2026-03-16 22:08:32 +03:00

closed this issue
added the
bug

need testing
labels

kerem commented

2026-03-16 22:08:48 +03:00

Author

Owner

@bcortezf commented on GitHub (Mar 21, 2025):

I'm closing this issue because I realized that my server was set as a DMZ Host, meaning all ports were exposed to the public.

Additionally, the PostgreSQL container had port 5432 open, and to make things worse, I was using the default database credentials.

The rest speaks for itself.

Let this be a lesson on how not to do things!

@bcortezf commented on GitHub (Mar 21, 2025): I'm closing this issue because I realized that my server was set as a DMZ Host, meaning all ports were exposed to the public. Additionally, the PostgreSQL container had port 5432 open, and to make things worse, I was using the default database credentials. The rest speaks for itself. Let this be a lesson on how not to do things!