| タイトル | https://github.com/massCodeIO/massCode massCode 5.10 Local Sensitive Logic Exposure leading to airbitary notes/code r |
|---|
| 説明 | The local HTTP service exposed by massCode can be accessed by callers outside the intended application boundary.
During testing, the massCode API was observed to listen on all network interfaces, rather than being restricted exclusively to the loopback interface. At the same time, the API enables permissive cross-origin access:
// src/main/api/index.ts
.use(cors({ origin: '*' }))
Sensitive Notes and Snippets endpoints do not require authentication or another trusted-client credential.
Examples include:
GET /notes
GET /notes/:id
POST /notes
PATCH /notes/:id/content
DELETE /notes/:id
GET /snippets
GET /snippets/:id
GET /note-folders
POST /note-tags
Consequently, an attacker-controlled web page may be able to communicate directly with the massCode API running on the victim's machine and retrieve sensitive local information, including:
the user's Notes list;
complete Note contents;
code Snippet metadata;
complete code Snippet contents.
Where state-changing endpoints are reachable, the exposed API may additionally allow unauthorized creation, modification, or deletion of locally stored data. |
|---|
| ソース | ⚠️ https://github.com/massCodeIO/massCode/issues/966 |
|---|
| ユーザー | Anonymous User |
|---|
| 送信 | 2026年10月09日 08:06 (13 日 ago) |
|---|
| モデレーション | 2026年10月21日 20:13 (13 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 424941 [massCodeIO massCode 5.10 Local HTTP Service src/main/api/index.ts 情報漏えい] |
|---|
| ポイント | 20 |
|---|