| शीर्षक | https://github.com/massCodeIO/massCode massCode 5.10 Local Sensitive Logic Exposure leading to airbitary notes/code r |
|---|
| विवरण | The local HTTP service exposed by massCode can be accessed by callers outside the intended application boundary.
During testing, the massCode API was observed to listen on all network interfaces, rather than being restricted exclusively to the loopback interface. At the same time, the API enables permissive cross-origin access:
// src/main/api/index.ts
.use(cors({ origin: '*' }))
Sensitive Notes and Snippets endpoints do not require authentication or another trusted-client credential.
Examples include:
GET /notes
GET /notes/:id
POST /notes
PATCH /notes/:id/content
DELETE /notes/:id
GET /snippets
GET /snippets/:id
GET /note-folders
POST /note-tags
Consequently, an attacker-controlled web page may be able to communicate directly with the massCode API running on the victim's machine and retrieve sensitive local information, including:
the user's Notes list;
complete Note contents;
code Snippet metadata;
complete code Snippet contents.
Where state-changing endpoints are reachable, the exposed API may additionally allow unauthorized creation, modification, or deletion of locally stored data. |
|---|
| स्रोत | ⚠️ https://github.com/massCodeIO/massCode/issues/966 |
|---|
| उपयोगकर्ता | Anonymous User |
|---|
| सबमिशन | 09/10/2026 08:06 AM (13 दिन पहले) |
|---|
| संयम | 21/10/2026 08:13 PM (13 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 424941 [massCodeIO massCode 5.10 Local HTTP Service src/main/api/index.ts सूचना का प्रकटीकरण] |
|---|
| अंक | 20 |
|---|