| Title | Purocean Yank Note 3.93.0 OS Command Injection / Missing Authentication for Critical Funct |
|---|
| Description | Yank Note (repository: https://github.com/purocean/yn) is an Electron desktop application whose main process automatically starts an embedded Koa HTTP + Socket.IO server bound to `127.0.0.1:3044`. Two flaws combine in the Socket.IO `/ws` endpoint, which on connection spawns a real terminal via node-pty (`cmd.exe` on Windows) and wires the socket's `input` event to the pseudo-terminal, echoing terminal output back on the `output` event (`src/main/server/index.ts`, terminal handling at ~line 889: https://github.com/purocean/yn/blob/2410437d6c3919d91457abcdaaf7fe0b4315bb83/src/main/server/index.ts). First, the server's permission layer (`checkPermission()` in `src/main/server/index.ts`) grants **every tokenless request originating from localhost the full `admin` role**, so the terminal endpoint performs no effective authentication. Second, the WebSocket handshake performs **no `Origin` validation**.
Because browsers allow JavaScript on any website to open WebSocket connections to `127.0.0.1`, and WebSocket connections are not subject to CORS (no preflight, no same-origin read restriction), any webpage open in any browser on the victim's machine — regardless of its origin — obtains a bidirectional, fully readable shell channel. A spoofed `Origin` header (e.g. `http://evil.example`) is accepted. Reproduction, verified live on Windows 11 against the v3.93.0 portable build: connect to `ws://127.0.0.1:3044/ws/?EIO=4&transport=websocket` using the Engine.IO v4 / Socket.IO v4 protocol (answer the server heartbeat `2` with `3`, send `40` to connect the namespace), then emit `42["input","whoami\r"]` — the command executes in the spawned `cmd.exe` and every `42["output", ...]` frame streams the output back to the attacking page. Shell banner, `whoami`, directory listings and a marker-file creation were all verified through the socket. No user interaction is required beyond the malicious page being open in a browser while Yank Note is running; no token and no click are needed.
This gives any website a fully interactive, output-readable command shell running as the logged-in user on every machine where Yank Note is running: arbitrary command execution with output (reconnaissance), clipboard theft via `Get-Clipboard` (passwords, copied secrets), dumping of files, credentials and browser profiles, and installation of further payloads. Reported to the maintainer on 2026-10-03 as GitHub issue https://github.com/purocean/yn/issues/531; fixed in the development branch on 2026-10-07 in commit https://github.com/purocean/yn/commit/59f85d48f17a70a402ad59dcecacdbec20f954df (pull request https://github.com/purocean/yn/pull/535, which now validates terminal HTTP/polling/upgrade and pre-PTY requests for source, Host and loopback), but no fixed release had been published at the time of this submission — the latest release is still https://github.com/purocean/yn/releases/tag/v3.93.0. |
|---|
| Source | ⚠️ https://github.com/purocean/yn/issues/531 |
|---|
| User | CopperKoi (UID 102109) |
|---|
| Submission | 10/13/2026 16:19 (22 days ago) |
|---|
| Moderation | 11/04/2026 19:38 (22 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 431157 [Purocean Yank Note 3.93.0 Terminal src/main/server/index.ts checkPermission os command injection] |
|---|
| Points | 20 |
|---|