@mockoon/cli@9.6.0

@mockoon/cli is a Mockoon's CLI. Deploy your mock APIs anywhere.

Affected versions of this package are vulnerable to Missing Authentication for Critical Function in admin-api.ts, which mounts the admin API on the same listener as user-defined mock routes (enabled by default via packages/cli/src/commands/start.ts and packages/serverless/src/libs/serverless.ts) and serves every endpoint with Access-Control-Allow-Origin: *, all HTTP methods, and no authentication. An attacker can read MOCKOON_* secrets, overwrite arbitrary process.env variables, rewrite mock route responses at runtime, and harvest consumer request bodies and authentication headers from the logs by sending unauthenticated requests to the /mockoon-admin endpoints, and the wildcard CORS lets these requests land cross-origin from a browser when a developer visits a malicious site while the server runs. Exploitation requires network reach to the mock server port, which by default binds to all interfaces at 0.0.0.0:3000 with the admin API enabled, while the cross-origin path additionally requires the developer to visit a malicious site during a local run.

Upgrade @mockoon/cli to version 9.7.0 or higher.