CyberRota Analysis
AI-GeneratedMockoon's admin API prior to version 9.7.0 is vulnerable due to its lack of authentication and default exposure on the same Express listener as user-defined mock routes, allowing unauthenticated access to sensitive operations. Attackers can exploit this vulnerability to read environment variables, modify mock routes, and access transaction logs, potentially leading to data leakage and unauthorized modifications. Organizations using Mockoon for API development should prioritize upgrading to version 9.7.0 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: * with write methods allowed, and has no authentication. Any unauthenticated caller who can reach the mock server port can read MOCKOON_* environment variables, write arbitrary process environment variables through /mockoon-admin/env-vars, rewrite mock route bodies, statuses, and headers through PUT /mockoon-admin/environment, read transaction logs and SSE streams, and purge state. This issue is fixed in version 9.7.0.