T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/live-server.mjs:181- Finding
Unauthenticated live.js endpoint discloses the privileged session token cross-origin
- Content
View full analysis
{ const url = new URL(req.url, `http://localhost:${state.port}`); res.setHeader('Access-Control-Allow-Origin', '*'); res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS'); res.setHeader('Access-Control-Allow-Headers', 'Content-Type'); if (req.method === 'OPTIONS') { res.writeHead(204); res.end(); return; } const p = url.pathname; // --- Scripts --- if (p === '/live.js') { let liveScript; try { liveScript = fs.readFileSync(livePath, 'utf-8'); } catch (err) { res.writeHead(500, { 'Content-Type': 'text/plain' }); res.end('Error reading live-browser.js: ' + err.message); return; } const body = `window.__IMPECCABLE_TOKEN__ = '${state.token}';\n` + `window.__IMPECCABLE_PORT__ = ${state.port};\n` + liveScript; ``` ### Technical Analysis The helper server binds to `127.0.0.1`, but loopback binding does not prevent websites loaded in the victim's browser from sending requests to it. The server applies `Access-Control-Allow-Origin: *` to every response and serves `/live.js` without authentication. The response embeds the session bearer token in executable JavaScript. Consequently, an arbitrary website can attempt to fetch common live-mode ports such as `8400`, read the response because of the wildcard CORS policy, and extract `window.__IMPECCABLE_TOKEN__`. The disclosed token authenticates endpoints that: - Read project source through `/source` - Read `DESIGN.md` and `DESIGN.json` - Submit browser events - Poll events containing selected DOM content - Upload annotation screenshots - Stop the live helper server The local HTTP tran ...[truncated 1310 chars]- Remediation
View remediation