PT-2018-17558 · Anchorfree · Hotspot Shield

Paulos Yibelo · Published 2018-01-31 · Updated 2025-11-23 · CVE-2018-6460

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hotspot Shield (affected versions not specified)

Description The issue concerns a web server running on Hotspot Shield with a static IP address and port 895. This web server utilizes JSONP and stores sensitive configuration information. An unauthenticated attacker can exploit this by sending a POST request to the "/status.js" API endpoint with the parameter func=$ APPLOG.Rfunc, allowing them to extract sensitive machine information. This includes details about the user's VPN connection status, the specific VPN connected to, and the user's real IP address.

Recommendations For Hotspot Shield, consider restricting access to the "/status.js" API endpoint to prevent unauthorized data extraction until a patch is available. As a temporary workaround, disabling the $ APPLOG.Rfunc parameter in the POST request to "/status.js" may help mitigate the risk of sensitive information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-6460

Affected Products

Hotspot Shield

References · 5

• 🔥 https://blogs.securiteam.com/index.php/archives/3604 · Exploit
• 🔥 https://exploit-db.com/exploits/44042 · Exploit
• 🔥 http://paulosyibelo.com/2018/02/hotspot-shield-cve-2018-6460-sensitive.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-6460 · Security Note
• https://reddit.com/r/VPNforFreedom/comments/1p4dwtl/can_police_track_vpn · Reddit Post