Information Disclosure in netdisk-fast-download via Unauthenticated Endpoint

Executive Summary

This vulnerability is an information disclosure flaw in netdisk-fast-download through version 0.4.8. It allows unauthenticated attackers to retrieve donated netdisk credentials by exploiting the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call this endpoint and decrypt the encryptedAuth blob using a hard-coded AES key (nfd_auth_key2026) to recover other users' cloud-drive cookies, tokens, or passwords.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for repeated requests to the /v2/randomAuth endpoint. Use tools like curl to test if the endpoint leaks credentials by sending GET requests with panType parameters and checking for encrypted blobs that can be decrypted using the hard-coded key nfd_auth_key2026.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to other users' cloud storage accounts, exposing sensitive data like cookies, tokens, or passwords. Attackers could impersonate users, access private files, or perform actions on their behalf without consent.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. The flaw could result in data breaches, leading to legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately disable the /v2/randomAuth endpoint in ParserApi. Remove the hard-coded AES key nfd_auth_key2026 from the codebase. Update to a patched version if available. Restrict access to the service and monitor for unauthorized access attempts.

Useful 0 Not Useful 0