# @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Rsdoctor's default build report server binds 0.0.0.0 with wildcard CORS and an unauthenticated POST /api/data/key, letting LAN attackers dump all module source code.

- Payout: Research
- Severity: high
- Program: Rsdoctor
- Found by: EQSTLab
- Disclosed: 2026-09-24
- CVE: CVE-2026-61782
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-jmg2-rcxh-w8q3
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-jmg2-rcxh-w8q3
- Tags: area:web domain:oss domain:web impact:data-leak kind:research platform:ghsa sev:high tech:nodejs technique:source-review vuln:cors vuln:info-disclosure vuln:misconfiguration

**Target:** Rsdoctor report HTTP server (POST /api/data/key)
**Root cause:** The report server calls server.listen(port) with no host, defaulting to 0.0.0.0, applies wildcard CORS, and registers POST /api/data/key with no auth; the attacker-controlled key indexes the whole SDK data store including moduleCodeMap.
**Steps:**
1. Install @rsdoctor/rspack-plugin@1.5.11 with @rspack/core and enable the plugin with default settings.
2. Run rspack; the Rsdoctor server starts on 0.0.0.0 and prints a port, e.g. http://<lan-ip>:3717/index.html.
3. From another host send `curl -s "http://<victim-lan-ip>:<port>/api/data/key" -H 'Content-Type: application/json' --data '{"key":"moduleCodeMap"}'`.
4. Response contains full source of every compiled module, including embedded secrets.
5. Secondary probe with `{"key":"configs"}` returns serialized build config with absolute paths.
**How found:** Code review of the SDK server: noticed server.listen(port) without host, unconditional cors() plus explicit Access-Control-Allow-Origin: *, a route with no auth middleware, and a key used to index getStoreData() with dot-path traversal and no allowlist.
**Exploitation:** No auth or interaction needed: any host on the LAN/VPN/shared Wi-Fi POSTs {"key":"moduleCodeMap"} to the auto-started server and receives all module source; a malicious website can also fetch http://127.0.0.1:<port>/api/data/key cross-origin due to wildcard CORS.
**Insight:** Dev-tool report servers are a recurring leak class: grep for listen(port) without a host argument and for data-store lookup endpoints keyed by client-supplied strings, then check whether moduleCodeMap/configs are in the default store.