Mousehole
Monthly
Unauthenticated access to Mousehole's HTTP/WebSocket management interface (port 5010) exposes the stored MyAnonamouse (MAM) session cookie to any network peer in versions prior to 0.4.0. The service serializes its internal state - including the live MAM session cookie - identically across persisted storage, public API responses, and WebSocket push updates, meaning a passive read of any endpoint yields the credential. An attacker who can reach port 5010 can additionally overwrite the stored cookie and trigger MAM IP-update side effects, turning a disclosure into account manipulation. No public exploit code has been identified at time of analysis.
Unauthenticated access to Mousehole's HTTP/WebSocket management interface (port 5010) exposes the stored MyAnonamouse (MAM) session cookie to any network peer in versions prior to 0.4.0. The service serializes its internal state - including the live MAM session cookie - identically across persisted storage, public API responses, and WebSocket push updates, meaning a passive read of any endpoint yields the credential. An attacker who can reach port 5010 can additionally overwrite the stored cookie and trigger MAM IP-update side effects, turning a disclosure into account manipulation. No public exploit code has been identified at time of analysis.