| 제목 | https://github.com/massCodeIO/massCode massCode 5.10 Local Sensitive Logic Exposure leading to airbitary notes/code r |
|---|
| 설명 | The local HTTP service exposed by massCode can be accessed by callers outside the intended application boundary.
During testing, the massCode API was observed to listen on all network interfaces, rather than being restricted exclusively to the loopback interface. At the same time, the API enables permissive cross-origin access:
// src/main/api/index.ts
.use(cors({ origin: '*' }))
Sensitive Notes and Snippets endpoints do not require authentication or another trusted-client credential.
Examples include:
GET /notes
GET /notes/:id
POST /notes
PATCH /notes/:id/content
DELETE /notes/:id
GET /snippets
GET /snippets/:id
GET /note-folders
POST /note-tags
Consequently, an attacker-controlled web page may be able to communicate directly with the massCode API running on the victim's machine and retrieve sensitive local information, including:
the user's Notes list;
complete Note contents;
code Snippet metadata;
complete code Snippet contents.
Where state-changing endpoints are reachable, the exposed API may additionally allow unauthorized creation, modification, or deletion of locally stored data. |
|---|
| 원천 | ⚠️ https://github.com/massCodeIO/massCode/issues/966 |
|---|
| 사용자 | Anonymous User |
|---|
| 제출 | 2026. 10. 09. AM 08:06 (13 날 ago) |
|---|
| 모더레이션 | 2026. 10. 21. PM 08:13 (13 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 424941 [massCodeIO massCode 5.10 Local HTTP Service src/main/api/index.ts 정보 공개] |
|---|
| 포인트들 | 20 |
|---|