| Title | Purocean Yank Note 3.93.0 Information Disclosure |
|---|
| Description | Yank Note (repository: https://github.com/purocean/yn) is an Electron desktop application whose main process automatically starts an embedded Koa HTTP server bound to `127.0.0.1:3044`. The endpoint `GET /api/settings` (`src/main/server/index.ts:611`: https://github.com/purocean/yn/blob/2410437d6c3919d91457abcdaaf7fe0b4315bb83/src/main/server/index.ts) returns `config.getAll()` — the entire persisted application configuration — **without any authentication**, because the server's permission layer (`checkPermission()` in `src/main/server/index.ts`) grants every tokenless request originating from localhost the full `admin` role. Among the returned values is `server.jwt-secret`: the HS256 signing key for the application's own bearer tokens, a 32-hex-character secret generated on first use and persisted in plaintext in `userdata/config.json`.
Any process on the machine can retrieve the key with `curl http://127.0.0.1:3044/api/settings`. From a browser page, the response carries no `Access-Control-Allow-Origin` header, so a cross-origin `fetch()` cannot read it directly — but direct navigation (link click / `window.open`) displays the full JSON, and the key is also trivially exfiltrated through any other local read primitive (for example the unauthenticated interactive WebSocket shell reported in issue #531, or the arbitrary file-read reported in the same advisory series). Once the key is known, token forgery is fully offline: the token implementation (`src/main/jwt.ts`: https://github.com/purocean/yn/blob/2410437d6c3919d91457abcdaaf7fe0b4315bb83/src/main/jwt.ts) uses headerless `payload.signature` tokens and re-attaches a fixed HS256 header at verification time, so an attacker simply signs their own `{"role": "admin"}` payload. The forged token is accepted via the `_token` query parameter, the `Authorization` header, or `x-yn-authorization`, and remains valid even in contexts where the loopback-IP check would not grant admin. This was verified live: no token returns the full configuration; a forged **guest** token returns the configuration with secrets stripped; a forged **admin** token returns the full unredacted configuration including `jwt-secret`.
With a forged admin JWT the attacker gains the complete authenticated admin API of the embedded server, including `POST /api/rpc`, which evaluates arbitrary JavaScript inside the **Electron main process** (full RCE), plus all file and extension-management endpoints. The signing key is long-lived — persisted to disk in plaintext and never rotated — so a single disclosure compromises the installation until the data directory is reset. Reported to the maintainer on 2026-10-03 as GitHub issue https://github.com/purocean/yn/issues/532; fixed in the development branch on 2026-10-07 in commit https://github.com/purocean/yn/commit/59f85d48f17a70a402ad59dcecacdbec20f954df (pull request https://github.com/purocean/yn/pull/535, which removes `server.jwt-secret` from the settings responses), but no fixed release had been published at the time of this submission — the latest release is still https://github.com/purocean/yn/releases/tag/v3.93.0. |
|---|
| Source | ⚠️ https://github.com/purocean/yn/issues/532 |
|---|
| User | CopperKoi (UID 102109) |
|---|
| Submission | 10/13/2026 16:21 (22 days ago) |
|---|
| Moderation | 11/04/2026 19:35 (22 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 431155 [purocean Yank Note 3.93.0 Settings Endpoint src/main/server/index.ts config.getAll information disclosure] |
|---|
| Points | 20 |
|---|