1. User opens a malicious webpage controlled by the attacker
2. The page’s JS directly requests the local address http://127.0.0.1:38324
Key point: Browser pages can access local loopback addresses; binding only to 127.0.0.1 does not block web JS from initiating requests.
3. The Sub‑Store local service lacks authentication, directly accepting externally sent requests without requiring a password or token.
4. The API response header includes Access‑Control‑Allow‑Origin: * , allowing CORS so the webpage JS can read the returned data.
5. The malicious webpage sends a POST request to /api/preview/sub , injecting malicious script code.
6. Sub‑Store internally uses new Function() to dynamically execute the injected script.
7. The malicious script accesses Node’s underlying module: require(“child_process”)
8. It uses execSync() to execute system commands locally, for example: whoami to query the current user.
9. Replacing the command with certutil allows downloading a trojan and executing it on the PC, resulting in a full compromise.
This looks like Clash may have been compromised. No competent developer would normally enable Access-Control-Allow-Origin: *; it’s clearly a CORS attack from the local network.
I don’t like using Clash. I usually use Windows machines, and I found that running Clash for extended periods can cause system problems, so I stopped using it altogether. Clash seems to work better on Mac, but I haven’t run it for long periods on Mac either, so I can’t really say.
It’s actually Sub-Store in Clash (the title needs to be attention-grabbing , as advised by a journalism expert). Clash Party and Sparkle are known to be affected; simply stop using Sub-Store.
Yeah, that’s right. Clash has always had a bit of an issue with kernel resource scheduling on Windows. Plenty of users report memory leaks, and it starts lagging after prolonged use, but the official team doesn’t seem to have done much optimization.
In an act of urgency, I have published a new blog post to hopefully reduce the number of victims impacted by the bug I discovered in Sub-Store. I unfortunately do not speak Chinese, but modern translation tools are good enough to convey the information. A poisoned jQuery file turned SpeedyBee into a malware carrier - kabir.au
Clickbait headline, huh? What do you mean by a “Clash vulnerability”?
Running any configuration file you come across is your own problem, and in a normal network environment, how could you expose an API directly to the public internet?
A security expert from overseas replied in the comments—check out their analysis yourself. This problem actually came up when some folks in the group were using Clash Party and Sparkle (sub-store), which means there could be more undetected security risks lurking. Does it really matter if the title focuses on Sparkle/sub-store or Clash? You pick. If you think the post is misleading, all hype without substance, or just the result of your own mishandling (look, it wasn’t me who fell victim, so maybe it wasn’t worth sharing anyway), go ahead and report it . Honestly, I didn’t dig too deep into the analysis myself (as I mentioned at the end, I was just hoping some pros would step in with a proper security audit).
, as advised by a journalism expert). Clash Party and Sparkle are known to be affected; simply stop using Sub-Store.
What do you mean by a “Clash vulnerability”?
. Honestly, I didn’t dig too deep into the analysis myself (as I mentioned at the end, I was just hoping some pros would step in with a proper security audit).