Critical Vulnerability Report: Discord macOS Client

Date: 2026-01-25 Target: Discord Client (macOS Stable 0.0.373) Author: Antigravity

🚨 Executive Summary

We have identified a critical security vulnerability in the Discord macOS Client (Electron-based) involving the forced exposure of the Remote Debugging Port (9222) via local configuration or command-line flags. This allows a local attacker to completely bypass authentication (2FA, Password) and achieve Remote Code Execution (RCE) context within the client.

CVE Status Check

• Distinct Vector: This vulnerability is distinct from the previously reported CVE-2024-23739 (RunAsNode RCE).
• Zero-Day Status: There is currently no assigned CVE for the "Remote Debugging Port Exposure" on Discord macOS. This is classified as a Zero-Day (or Unpatched N-Day) Configuration Vulnerability.
• New Threat Model: While settings.json injection is a known technique, demonstrating Worm Propagation and Real-Time Spyware capabilities elevates this to a critical security risk.

💥 Exploitation Scenarios (Impact Analysis)

1. Zero-Click Account Takeover (ATO)

• Mechanism: Invoking getToken() via the Debug Console to extract the unencrypted User Token.
• Impact: The attacker gains immediate access to the account from any location, bypassing Password and 2FA requirements.

2. Real-Time Spyware (Verified)

• Mechanism: Utilizing Network.enable and DOM access via the Debug Port to capture all rendered text and WebSocket traffic.
• Verified PoC: The script discord_spyware_v2.py successfully extracted the victim's Private DM List and Server List (e.g., "White Hat Community", "LGU+ Security Hackathon") as plaintext in real-time.
• Evidence: See proof_spyware.png (Terminal output showing extracted private UI text).
• Impact: Complete loss of privacy. Attackers can monitor private conversations and hidden channels silently.

3. Automated Worm Propagation

• Mechanism: Controlling the Chat Input (Textarea) via DOM manipulation to auto-send malicious links to all friends and server members.
• Impact: Potentially massive viral spread of malware leveraging the victim's trust.

4. Invisible Persistence (Backdoor)

• Mechanism: Modifying settings.json to permanently enable the debug port on every application launch.
• Impact: The backdoor remains active indefinitely without triggering antivirus software, as it uses legitimate Discord flags.

🛠️ Proof of Concept (Technical Verification)

The vulnerability was verified through the following steps:

1. Exploit: Launching Discord with --remote-debugging-port=9222.
2. Access: Connecting to the local WebSocket Debugger URL.
3. Execution: Injecting alert("GOD MODE ACTIVE") to freeze the UI (Screen Defacement) and executing discord_spyware_v2.py to dump screen content.

🛡️ Remediation

1. Disable Debug Flags: Production builds should explicitly ignore dangerous command-line switches like --remote-debugging-port. (Disable in electron.main).
2. Integrity Checks: Critical configuration files like settings.json should be signed (HMAC) or encrypted to prevent external tampering.