| Title | vvbbnn00 (https://github.com/vvbbnn00) WARP-Clash-API latest (main/master branch) CWE-284 (Improper Access Control / Broken Access Control - autho |
|---|
| Description | Credential Leakage via URL Query Parameter in Subscription Artifacts — Location: `services/subscription.py:~226`. When generating a Surge subscription file, the `get_surge_subscription()` function constructs the subscription URL as follows: `public_url += f"&key={SECRET_KEY}"`. The raw SECRET_KEY is embedded directly as a query parameter in the `.conf` file returned to the client. This key is the same credential that guards all account-management endpoints (`/api/account`, `/api/account/reset_key`, `/api/account/update_license`). The business rule violated is that the master API credential should never be distributed to subscription consumers, who only need VPN configuration data. However, the key is also accepted via `request.args.get('key')` in the `authorized()` decorator at `web_service.py:48`, meaning any extracted key can be used directly to call management APIs. Furthermore, URLs containing query parameters are routinely persisted in: (a) the user's local config file (Surge .conf), (b) web server access logs, (c) reverse proxy logs, (d) browser history if shared via link, and (e) Referer headers if the subscription URL is visited from a web page. Exploitation: 1. Operator shares a Surge subscription link with a user so they can use the VPN. 2. That user imports the subscription in Surge, downloading the `.conf` file containing `&key=<SECRET_KEY>`. 3. User extracts the SECRET_KEY from the config. 4. User calls `POST /api/account/reset_key` with the extracted key (`curl -X POST "http://host:21001/api/account/reset_key?key=<SECRET_KEY>"`), rotating the WireGuard keypair and locking out the operator. 5. User calls `POST /api/account/update_license` to bind a different Cloudflare license, hijacking the account quota. If an attacker does not have legitimate access to the subscription, they can also obtain the key via: log inspection (access to apache/nginx logs that captured the subscription request URL), network interception if the subscription is retrieved over HTTP, or Referer header leakage when the subscription download URL is linked from an attacker-controlled page. |
|---|
| Source | ⚠️ https://gist.github.com/Galaxync/26062162d9cc27550795cdc100da2dcb |
|---|
| User | Galaxyn (UID 98388) |
|---|
| Submission | 07/19/2026 04:07 (2 months ago) |
|---|
| Moderation | 09/12/2026 10:47 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 403095 [vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46 Subscription services/subscription.py get_surge_subscription key access control] |
|---|
| Points | 20 |
|---|