When using mockttp with the optional remote admin server enabled (getAdminServer().start()) it binds to all network interfaces via address 0.0.0.0, in the default configuration, or if only a port option is supplied with no host.

This exposes the Mockttp admin API with no authentication required, allowing API clients to configure & start local test servers with their own custom rules. This allow access to significant functionality to anybody with direct network access to the exposed port on the machine. Most notably, in combination with remotely configured rules and access to the resulting dynamically created proxy port on the machine, an attacker could potentially use rules to expose process-readable files from the machine and then retrieve them by sending requests to the created mock server.

This does not affect use cases where:

• The remote admin server is not explicitly enabled (i.e. if only the standard getLocal() API is used, the admin API is not exposed).
• The remote admin server is used, but host: "localhost" or similar is passed to start(), to limit access to the local interface.
• A firewall is in place or ports are not exposed, such that unexpected external connections to the admin port (45456) are not allowed. Note that this applies to most default Docker & CI configurations (including GitHub Actions).
• The local network is trusted. This API will likely not be accessible beyond your LAN, unless all ports on the device are directly connected to the internet.

In other cases (admin server is used, with default settings, and is reachable by untrusted parties) any data that is readable by test process could have been exposed.

This admin API is only accessible while the admin server is running. In a typical testing configuration, that is just during the execution of the test runner.

In the patched versions (4.6.0 and 3.17.2) the default host option is changed to 127.0.0.1, so the Mockttp admin server is only accessible to local connections by default, unless explicitly configured.