| Title | https://github.com/maotoumao/MusicFreeDesktop MusicFreeDesktop 0.0.8 Local Sensitive Logic Exposure leading to forward any request |
|---|
| Description | In stable MusicFree Desktop v0.0.6–v0.0.8, the Electron application starts a request-forwarder on TCP port 52735 with server.listen(port) and no host argument. Node therefore listens on x.x.x.x and [::], exposing the unauthenticated forwarding API to every network interface.
Any machine on the same LAN or Wi-Fi can call the API without user interaction. The attacker can choose any target URL, HTTP method, and headers, and the response is returned to the caller. |
|---|
| Source | ⚠️ https://github.com/maotoumao/MusicFreeDesktop/issues/444 |
|---|
| User | Anonymous User |
|---|
| Submission | 10/12/2026 05:42 (17 days ago) |
|---|
| Moderation | 10/28/2026 16:54 (17 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 428017 [maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8 Request Forwarder information disclosure] |
|---|
| Points | 20 |
|---|