Netdisk Fast Download
Monthly
Credential disclosure in netdisk-fast-download through 0.4.8 allows unauthenticated remote attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint and decrypt them using the hard-coded AES key 'nfd_auth_key2026'. This can expose cloud-drive cookies, tokens, or passwords, resulting in high confidentiality impact. Exploitation requires that the target instance has the donation feature enabled and populated with credentials; no public exploit has been identified at time of analysis.
Credential disclosure in netdisk-fast-download through 0.4.8 allows unauthenticated remote attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint and decrypt them using the hard-coded AES key 'nfd_auth_key2026'. This can expose cloud-drive cookies, tokens, or passwords, resulting in high confidentiality impact. Exploitation requires that the target instance has the donation feature enabled and populated with credentials; no public exploit has been identified at time of analysis.