Information Disclosure in netdisk-fast-download via Hard-Coded Credentials

The netdisk-fast-download package, specifically versions through 0.4.8, contains a critical information disclosure vulnerability within its ParserApi. Unauthenticated attackers can interact with the /v2/randomAuth endpoint to retrieve encrypted credential blobs. These blobs are secured using a hard-coded AES key, identified as 'nfd_auth_key2026', which is embedded directly within the application code. By performing a simple decryption of the intercepted blob using this static key, an unauthorized party can successfully recover sensitive data belonging to other users. Exposed data includes cloud-drive cookies, authentication tokens, and potentially plain-text passwords. This vulnerability poses a significant risk to user privacy and account security, as it allows for trivial credential harvesting without requiring prior access or specific user interaction.

Impact

The vulnerability directly impacts the confidentiality of user cloud-drive accounts. Successful exploitation grants attackers unauthorized access to victim credentials, enabling them to hijack cloud sessions, exfiltrate sensitive files, or maintain persistence within the victim's storage environment. This issue affects all users running versions of netdisk-fast-download up to and including 0.4.8. Given the nature of the exposed information, this could lead to broad-scale account compromise across the user base.

Recommendation

Prioritize the immediate update of netdisk-fast-download to a version beyond 0.4.8 where this hard-coded key has been remediated. Monitor network traffic logs for repeated unauthorized access attempts to the /v2/randomAuth endpoint of the ParserApi. Ensure that any suspected exposure of cloud-drive credentials leads to immediate session invalidation and password rotation for affected accounts.