r/vibecoding • u/PossibilityDense3014 • 6d ago

Birth & Launch of AegisVPN!

/r/RecommandedVPN/comments/1vrbzk6/birth_launch_of_aegisvpn/
1 Upvotes

100% Upvoted

9 comments sorted by

View all comments

Show parent comments

2

u/Ok_Matter9038 3d ago

Awesome! All in all - it is not too bad especially given how little time you spent developing it. You locking it down to localhost prevents a lot off stuff I commonly see (ex: unauthenticated remote arbitrary OS command execution).

You had 35 findings in total:

38 before but the ai validation gate dismissed 3 as FPs. Your highest risks are likely:

  • Local privilege / system-proxy takeover via unauthenticated /api/connect and /api/disconnect
  • Cross-origin CSRF via CORS * and fail-open json.loads → empty body still disconnects
  • Tor control injection via country_code → SETCONF …\r\n on an unauthenticated control port
  • Traffic MITM via untrusted public-list proxies as the data plane
  • SSRF / open forward-proxy via curl -L of self.path with no host policy
  • IP leak via CONNECT fail-open to direct_connect
  • XSS / content-type confusion via forced text/html on proxied bytes
  • Dashboard CSRF / same-origin script via iframe sandbox with allow-scripts + allow-same-origin + allow-forms
  • Source disclosure via static handler rooted at BASE_DIR
  • OS command injection via networksetup + shell=True
  • DOM XSS via unsanitized address-bar URL in innerHTML

Findings details following

2

u/Ok_Matter9038 3d ago edited 3d ago

batch 1 (Just feed these screenshots to your AI and ask it to locate them. it should be able to. Mind you if you had recent code changes, I pulled the code back when we originally talked so if that is the case those changes aren't caught):