{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/scbe-aethermoore/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AetherBrowser (4.2.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":["SCBE-AETHERMOORE"],"content_html":"\u003cp\u003eThe SCBE-AETHERMOORE AetherBrowser API server, specifically in version 4.2.1, includes a critical information-disclosure vulnerability within \u003ccode\u003escripts/aetherbrowser/api_server.py\u003c/code\u003e. The \u003ccode\u003ePOST /api/ops/check-email\u003c/code\u003e endpoint is exposed without any authentication or authorization mechanisms, such as API-key validation or middleware access guards. By default, the application binds to all interfaces (\u003ccode\u003e0.0.0.0:8100\u003c/code\u003e) and is configured with wildcard CORS (\u003ccode\u003eallow_origins=[\u0026quot;*\u0026quot;]\u003c/code\u003e), making it accessible to any network-connected actor.\u003c/p\u003e\n\u003cp\u003eWhen invoked, the endpoint triggers the execution of \u003ccode\u003eemail_reader.py\u003c/code\u003e as a subprocess. This script automatically attempts to load credentials from \u003ccode\u003econfig/connector_oauth/.env.connector.oauth\u003c/code\u003e and initiates IMAP connections to configured ProtonMail or Gmail accounts. The API server captures the standard output of this process, which includes sender information, subjects, and body snippets of fetched RFC822 messages, and returns this sensitive data to the caller in a JSON response. This provides a mechanism for unauthorized actors to exfiltrate operational intelligence without requiring credentials or prior access to the host environment.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs network scanning to identify reachable instances of AetherBrowser listening on port 8100.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a standard HTTP POST request to the \u003ccode\u003e/api/ops/check-email\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eapi_server.py\u003c/code\u003e processes the request, bypassing authentication checks due to the missing \u003ccode\u003eDepends()\u003c/code\u003e decorator.\u003c/li\u003e\n\u003cli\u003eThe server executes \u003ccode\u003eemail_reader.py\u003c/code\u003e as a system subprocess (\u003ccode\u003e_run_subprocess\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eemail_reader.py\u003c/code\u003e script parses local environment files to retrieve configured IMAP credentials.\u003c/li\u003e\n\u003cli\u003eThe script establishes an IMAP connection to the target mail provider (ProtonMail or Gmail) using the retrieved credentials.\u003c/li\u003e\n\u003cli\u003eThe script fetches RFC822 messages, parses them, and writes email metadata to stdout.\u003c/li\u003e\n\u003cli\u003eThe API server intercepts the first 2000 characters of stdout and returns the email data to the attacker in the HTTP response.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to exfiltrate email metadata, including sender identities, subjects, and content snippets. This disclosure of sensitive operational communications can facilitate follow-on social engineering or targeted attacks against operators. Additionally, repeated calls to the endpoint can lead to IMAP connection exhaustion or account-level security alerts, effectively disclosing the operational infrastructure's mail configuration and diagnostic status.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003ePatch immediately by implementing mandatory API-key validation using a header-based check (e.g., \u003ccode\u003eX-API-KEY\u003c/code\u003e) for all \u003ccode\u003e/api/ops/*\u003c/code\u003e endpoints.\u003c/li\u003e\n\u003cli\u003eModify the API server configuration to bind only to \u003ccode\u003e127.0.0.1\u003c/code\u003e to prevent remote access unless explicitly required by the architecture.\u003c/li\u003e\n\u003cli\u003eDisable wildcard CORS (\u003ccode\u003eallow_origins=[\u0026quot;*\u0026quot;]\u003c/code\u003e) and restrict access to specific, trusted origins.\u003c/li\u003e\n\u003cli\u003eImplement strict input and output sanitization for subprocess interactions; the application should not return raw stdout from operational scripts to external API callers.\u003c/li\u003e\n\u003cli\u003eRotate all mail credentials stored in \u003ccode\u003econfig/connector_oauth/.env.connector.oauth\u003c/code\u003e if it is suspected that the API was exposed to untrusted networks.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-26T02:06:58Z","date_published":"2026-09-26T02:06:58Z","id":"https://feed.craftedsignal.io/briefs/2026-09-aetherbrowser-unauth-api/","summary":"An unauthenticated API endpoint in SCBE-AETHERMOORE AetherBrowser allows remote attackers to trigger the execution of a subprocess that retrieves and exposes operator email metadata from IMAP accounts.","title":"Unauthenticated AetherBrowser API Exposes Operator Email Metadata","url":"https://feed.craftedsignal.io/briefs/2026-09-aetherbrowser-unauth-api/"}],"language":"en","title":"CraftedSignal Threat Feed - SCBE-AETHERMOORE","version":"https://jsonfeed.org/version/1.1"}