| Title | https://www.nstbrowser.io/en nstbroswer 1.2.1 DDOS |
|---|
| Description | ## 1. Vulnerability Description
After the user starts the Nstbrowser fingerprint browser, the client runs a local management service that listens on `127.0.0.1:8848` by default. The `/api/agent/browser/stopAll` endpoint exposed by this service is used to terminate all browser instances managed by the Agent.
In the scenario verified here, the endpoint does not require any authentication credential and does not validate the request origin. An attacker only needs to induce the user to visit a malicious web page. JavaScript on that page can first read `/api/agent/browser/running` to confirm that fingerprint browser instances are running, then request `/api/agent/browser/stopAll`. The Agent traverses browser process records in its local cache and terminates the corresponding processes one by one.
Because the operation affects every started browser instance, a malicious page can cause a bulk interruption of fingerprint browser sessions without authentication, without local code execution, and without a second confirmation from the user. The result is a denial-of-service condition. For automation tasks, multi-account workflows, or businesses that rely on long-lived browser sessions, the interruption may cause task failures, loss of working state, and service unavailability.
## 2. Scope and Trigger Conditions
### 2.1 Affected Components
- Local Agent management service.
- Default listening address: `127.0.0.1:8848`.
- Affected endpoint: `GET /api/agent/browser/stopAll`.
- Supporting endpoint: `GET /api/agent/browser/running`.
- Relevant internal logic: `stopAllBrowsers()`, SQLite cache query, process identification, and process termination.
### 2.2 Attack Prerequisites
1. The Nstbrowser Agent is already running on the victim host.
2. The Agent is listening on the local management port `8848`.
3. The user has started at least one Agent-managed browser instance through the fingerprint browser.
4. The user visits an attacker-controlled web page in a browser.
5. The malicious page can issue cross-origin requests to `127.0.0.1:8848`.
### 2.3 Attack Effect
- Terminates all Agent-managed `nstchrome` / `nstfox` browser processes.
- Interrupts all browser sessions currently used by the user.
- Produces a denial-of-service impact for automation or multi-instance workflows.
- The attacker does not need local code execution.
- The attacker does not need the user's password, token, or profileId.
## 3. Vulnerability Root Cause
### 3.1 Missing Endpoint Authorization
The Agent applies authorization inconsistently. `/browser/running` can be read without authentication, and `/browser/stopAll` can be triggered without authentication. During verification, the request carried neither `Authorization`, `X-Api-Key`, nor any other credential, yet `/browser/stopAll` still returned `200 success`.
This shows that the state-changing operation is not covered by the authentication layer. Because the endpoint uses the `GET` method, a cross-origin request from a web page can trigger it as an ordinary HTTP request. The attacker does not even need to read the response to complete the attack.
### 3.2 Key Source Code Analysis
In the client implementation, the core logic for bulk browser termination can be summarized as follows:
```text
GET /browser/stopAll
↓
stopAllBrowsers()
↓
Open the local SQLite database
↓
Query all browser startup cache records in the caches table
↓
Identify nstchrome / nstfox processes from cached PIDs
↓
Kill each matching process
```
The relevant implementation is shown below:
```javascript
function stopAllBrowsers() {
let db = null;
try {
let dbPath = path.join(
app.getPath("home"),
isTest ? ".nst-agent-test/data" : ".nst-agent/data"
);
db = new sqlite3.Database(dbPath, sqlite3.OPEN_READWRITE, (err) => {
if (err) {
logger.error("open data db error " + err.message);
} else {
db.all(
"SELECT * FROM caches WHERE namespace = 'cache_data_ns_default' and key like 'nstbrowser-agent:browser:%'",
(err, rows) => {
if (err) {
logger.error("select data db error", err.message);
} else {
for (const data of rows) {
if (data.value) {
let cache = JSON.parse(data.value);
let findProcess = getProcessInfoByPID(cache.pid);
if (
findProcess &&
(findProcess.name.toLowerCase().includes("nstchrome") ||
findProcess.name.toLowerCase().includes("nstfox"))
) {
killPID(findProcess.pid);
}
}
}
}
}
);
}
});
} catch (e) {
logger.error(`stopAllBrowsers caught exception with error: ${e}`);
} finally {
if (db) {
db.close((err) => {
if (err) {
logger.error("close DB error " + err.message);
}
});
}
}
}
```
This implementation exposes several key issues:
1. **Global scope**
`stopAllBrowsers()` is not limited to a single profileId. It iterates over all browser startup cache entries and terminates every matching process.
2. **Trusted use of cached PIDs**
The function reads browser cache records from the SQLite `caches` table and directly uses the `pid` value to locate and terminate a process.
3. **Process-name matching is sufficient for termination**
As long as a process name contains `nstchrome` or `nstfox`, the function calls `killPID()`. Therefore, once the logic is triggered through the endpoint, the impact covers all browser instances managed by the Agent.
4. **Process termination is bound to an unauthenticated endpoint**
`killPID()` forcibly terminates the target process:
```javascript
if (process.platform === "win32") {
command = `taskkill /F /PID ${pid}`;
} else if (process.platform === "darwin" || process.platform === "linux") {
command = `kill -9 ${pid}`;
}
```
Consequently, when an unauthenticated web page can invoke `stopAllBrowsers()`, all related browser instances are terminated.
### 3.3 Why a Malicious Web Page Can Trigger the Issue
Browsers allow a web page to send cross-origin HTTP requests to a service running on the user's local machine. Even if CORS prevents JavaScript from reading the response, the request itself may still have been sent and received by the local Agent.
For `/browser/stopAll`, the attacker does not depend on the response body. The state change occurs as long as the request reaches the server. Therefore, the attack does not require full cross-origin read access. |
|---|
| Source | ⚠️ https://drive.google.com/drive/folders/1TzU1aHKabEHbMmSbqVR4HhxTAxKO6XII?usp=drive_link |
|---|
| User | Anonymous User |
|---|
| Submission | 10/12/2026 01:06 (24 days ago) |
|---|
| Moderation | 11/04/2026 15:37 (24 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 431086 [NST Labs Tech Nstbrowser up to 1.2.1 Local Agent Management Service stopAll stopAllBrowsers denial of service] |
|---|
| Points | 20 |
|---|