| शीर्षक | mifi lossless-cut 3.69.0 Information Disclosure |
|---|
| विवरण | LosslessCut is an Electron-based lossless video editing tool. Its built-in HTTP API service (enabled via the `--http-api` command-line argument) listens on `127.0.0.1:8080` **without any authentication mechanism, CORS restrictions, or request origin validation**.
An attacker can send a UNC path (e.g., `\\attacker\share\file.mp4`) to the `/api/action/openFiles` endpoint, directly triggering the operating system's SMB client to initiate NTLM authentication with an attacker-controlled remote server, resulting in **the leakage of the victim's NTLMv2 hash credentials for the currently logged-in user**.
**An attacker only needs to send a single crafted POST request to the HTTP API at `localhost:8080` on the victim's host to capture the victim's NTLMv2 hash.** |
|---|
| स्रोत | ⚠️ https://my.feishu.cn/file/Jq4Ib90xeod3oPxlk77cv7jPnFe |
|---|
| उपयोगकर्ता | FoRever_ (UID 99203) |
|---|
| सबमिशन | 23/06/2026 04:51 AM (2 महीनों पहले) |
|---|
| संयम | 08/08/2026 06:35 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 387191 [mifi lossless-cut तक 3.69.0 Built-in HTTP API Service src/main/httpServer.ts अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|