T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/start.mjs:299- Finding
WeChat Bot Token Exposed Through an Unauthenticated Network Endpoint
- Content
View full analysis
{ server.listen(HTTP_PORT, () => { log(`HTTP service started: http://localhost:${HTTP_PORT}`); resolve(server); }); }); ``` ```js case 'confirmed': updated.message = 'Login successful!'; updated.connected = true; updated.botToken = data.bot_token; updated.ilinkBotId = data.ilink_bot_id; updated.ilinkUserId = data.ilink_user_id; updated.baseUrl = data.baseurl; log('Login successful!'); break; ``` ### Technical Analysis After pairing is confirmed, the complete bot token, bot identifier, user identifier, and service base URL are added to the status object. `writeStatus()` serializes that entire object into the status file. The `/status` endpoint subsequently returns the entire status object without authentication, field filtering, session validation, or authorization. The wildcard `Access-Control-Allow-Origin: *` header also permits scripts from arbitrary web origins to read the response when the endpoint is reachable. Calling `server.listen(HTTP_PORT)` without specifying a host normally binds the service to unspecified IPv6 or IPv4 interfaces, rather than guaranteeing a loopback-only listener. The log message describing the service as `localhost` does not enforce that restriction. The browser only needs pairing progress such as `wait`, `scaned`, `confirmed`, or `expi ...[truncated 1386 chars]- Remediation
View remediation