T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/server.js:86- Finding
Unauthenticated LAN Clients Can Read, Replace, and Control Teleprompter Sessions
- Content
View full analysis
{ clients.set(ws, { role: 'main' }); // default role ws.send(JSON.stringify({ type: 'state', ...state })); ws.on('message', (raw) => { try { const msg = JSON.parse(raw); if (msg.type === 'register') { clients.set(ws, { role: msg.role || 'main' }); broadcastRemoteCount(); } else if (msg.type === 'sync') { // Main teleprompter syncs state state = { idx: msg.idx, total: msg.total, current: msg.current || '', next: msg.next || '' }; broadcast({ type: 'state', ...state }, ws); } else if (msg.type === 'cmd') { // Remote sends command → broadcast to all (main will handle) broadcast({ type: 'cmd', action: msg.action }, ws); } else if (msg.type === 'text') { // Remote uploaded text → broadcast to all broadcast({ type: 'text', text: msg.text }, ws); } else if (msg.type === 'fulltext') { // Main syncs text to remotes broadcast({ type: 'fulltext', text: msg.text }, ws); } } catch {} }); ``` The network exposure is established at `scripts/server.js`, lines 117–124: ```js server.listen(PORT, '0.0.0.0', () => { console.log(`\n🎬 ClawPrompt Server`); console.log(` 电脑提词器: http://localhost:${PORT}`); console.log(` 手机遥控: http://${lanIP}:${PORT}/remote`); console.log(` (确保手机和电脑在同一 WiFi)\n`); }); ``` ### Technical Analysis The server listens on every network interface and accepts all WebSocket connections without credentials or a cryptographically random pairing token. The QR code only communicates the service URL; scanning it does not establish a trusted pairing relationship. A newly connected client immediately receives the current shared ...[truncated 1782 chars]- Remediation
View remediation