Ragingcactus

**Name of the Vulnerable Software and Affected Versions** YourSpotify versions prior to 1.8.0 **Description** The issue concerns a NoSQL injection vulnerability in the public access token processing logic. This allows attackers to bypass the public token authentication mechanism without user interaction or prerequisite knowledge. **Recommendations** For versions prior to 1.8.0, upgrade to version 1.8.0 to resolve the issue. As a temporary workaround, consider restricting access to the public access token processing logic until the upgrade is applied. Avoid using the public access token feature in affected versions until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** YourSpotify versions prior to 1.8.0 **Description** The issue allows attackers with access to a public token for guest access to obtain Spotify API tokens of users. This can lead to the extraction of profile information, listening habits, playlists, and other data from the corresponding Spotify profile. Additionally, attackers can control playback in the Spotify app. **Recommendations** For versions prior to 1.8.0, upgrade to version 1.8.0 to resolve the issue. As a temporary workaround, consider restricting access to the `/me` API endpoint until the upgrade is applied. Avoid using the public token feature in the settings until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** YourSpotify versions prior to 1.8.0 **Description** The issue concerns the use of a hardcoded JSON Web Token (JWT) secret in authentication tokens. This allows attackers to forge valid authentication tokens for any user, effectively bypassing authentication and potentially authenticating as admin users. **Recommendations** For versions prior to 1.8.0, upgrade to version 1.8.0 to address the issue. As a temporary workaround, consider restricting access to sensitive features until the upgrade is applied.

**Name of the Vulnerable Software and Affected Versions** YourSpotify versions prior to 1.9.0 **Description** The issue affects the API and login flow of YourSpotify, allowing attackers to execute Cross-Site Request Forgery (CSRF) attacks. This enables them to retrieve, modify, or delete data on the affected instance. Additionally, repeated CSRF attacks can lead to the creation of a new user and promotion to instance administrator if a legitimate administrator visits a malicious website. The exploitability of this issue depends on the victim's browser version and settings. **Recommendations** For versions prior to 1.9.0, upgrade to version 1.9.0 to address the issue. As a temporary workaround, consider restricting access to the API and login flow until the upgrade is applied. Note that there are no known workarounds for this issue, and upgrading to the fixed version is the recommended resolution.

**Name of the Vulnerable Software and Affected Versions** YourSpotify versions prior to 1.9.0 **Description** The issue concerns a clickjacking vulnerability that can be used to trick an existing user into triggering actions, such as allowing signup of other users or deleting the current user account. Clickjacking works by opening the target application in an invisible iframe on an attacker-controlled site and luring a victim to visit the attacker page and interact with it. By positioning elements over the invisible iframe, a victim can be tricked into triggering malicious or destructive actions in the invisible iframe, while they think they interact with a totally different site altogether. This can result in a high impact to the integrity of YourSpotify. **Recommendations** For versions prior to 1.9.0, upgrade to version 1.9.0 to address the issue. As a temporary workaround, consider restricting access to the YourSpotify instance to minimize the risk of exploitation. Avoid using YourSpotify while logged in and visiting other sites to reduce the risk of clickjacking attacks.