YMFE Yapi Improper Certificate Validation Vulnerability

A vulnerability exists in YMFE Yapi version 1.12.0, where the application improperly validates TLS/SSL certificates. This is achieved by configuring the Axios HTTPS agent to disable certificate validation, allowing man-in-the-middle attackers to spoof servers and intercept sensitive information.

Impact

Exploitation of this vulnerability allows for man-in-the-middle attacks, where an attacker can intercept and potentially alter communications between the client and server.