제출 #864287: Roo-Code v3.51.1 Cleartext Transmission of Sensitive Information

### Description

Roo-Code uses an insecure HTTP callback URL for OAuth authentication, allowing attackers on the same network to intercept authorization codes and gain unauthorized access to user accounts. The OAuth implementation uses `http://localhost:54545/callback` instead of HTTPS, violating OAuth 2.0 security best practices (RFC 6749 Section x.x.x.x).

Vulnerable code location:
```typescript
// src/integrations/claude-code/oauth.ts:12
const redirectUri = "http://localhost:54545/callback"; // ❌ HTTP instead of HTTPS
```

The vulnerability chain:
1. OAuth callback configured with `http://` protocol instead of `https://`
2. Authorization codes transmitted in cleartext over HTTP
3. No TLS/SSL protection for localhost callback
4. Security guardrail SF-12 (OAuth Security) not enforcing HTTPS

This allows network attackers (e.g., on public WiFi) to intercept OAuth authorization codes through ARP spoofing or packet sniffing, gaining full access to victim's Claude Code account.

### Root cause

- Entry route:
OAuth authentication callback
- Preconditions:
Attacker on same network as victim during OAuth flow
- Vulnerable code:
`src/integrations/claude-code/oauth.ts:12` - HTTP redirect URI
- Root cause:
OAuth callback uses unencrypted HTTP protocol for localhost, allowing cleartext transmission of authorization codes
- Controlling factor:
Security guardrail SF-12 does not enforce HTTPS for OAuth callbacks

### Proof of Concept

**Attack Setup:**

```bash
# Attacker on same network as victim
sudo arpspoof -i wlan0 -t <victim_ip> <gateway_ip>
sudo tcpdump -i wlan0 -A 'tcp port 54545' -w oauth_capture.pcap
```

**Attack Steps:**
1. Victim opens Roo-Code and initiates OAuth login on public WiFi or shared network
2. Victim completes authentication on OAuth provider website
3. OAuth provider redirects to: `http://localhost:54545/callback?code=SplxlOBeZQQYbYS6WxSbIA&state=xyz`
4. Attacker captures HTTP GET request in cleartext using Wireshark, tcpdump, or ARP spoofing
5. Attacker extracts authorization code: `SplxlOBeZQQYbYS6WxSbIA`
6. Attacker exchanges code for access token before legitimate client completes the exchange
7. Attacker gains full access to victim's Claude Code account with all associated permissions

**Captured Traffic Example:**

```
GET /callback?code=SplxlOBeZQQYbYS6WxSbIA&state=xyz HTTP/1.1
Host: localhost:54545
User-Agent: Mozilla/5.0
Accept: text/html
```

### Expected behaviour

Authorization codes should be protected by TLS encryption. OAuth callback should use `https://localhost:54545/callback` or implement localhost TLS certificate.

### Observed behaviour

Authorization code transmitted in cleartext over HTTP, easily intercepted by network attackers using standard traffic analysis tools.

### CWE Classification

- CWE-319: Cleartext Transmission of Sensitive Information
- CWE-523: Unprotected Transport of Credentials
- CWE-940: Improper Verification of Source of a Communication Channel

• 원천: ⚠️ https://gist.github.com/tchen200311/dcf3d36781e8246876cde7965fdda490
• 사용자: tchen200311 (UID 97733)
• 제출: 2026. 06. 20. AM 04:00 (2 개월 ago)
• 모더레이션: 2026. 08. 27. PM 04:49 (2 months later)
• 상태: 수락
• VulDB 항목: 396169 [RooCodeInc Roo-Code 까지 3.51.1 OAuth Callback oauth.ts 약한 암호화]
• 포인트들: 20