PT-2024-31706 · Unknown · Whatsapp-Api-Js

Secreto31126 · Published 2024-09-12 · Updated 2024-09-19 · CVE-2024-45607

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: whatsapp-api-js versions prior to 4.0.3

Description: The issue concerns Incorrect Access Control in the whatsapp-api-js framework, impacting anyone using the post or verifyRequestSignature methods to handle messages. It is possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid.

Recommendations: For versions prior to 4.0.3, update to version 4.0.3 to resolve the issue. As a temporary workaround, consider using a custom function like doPost, which checks the payload validation using whatsapp.verifyRequestSignature and throws an error if the signature is valid, before proceeding with the post method.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2024-45607

GHSA-MWHF-VHR5-7J23

Affected Products

Whatsapp-Api-Js

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45607.json · Exploit
• https://github.com/Secreto31126/whatsapp-api-js/security/advisories/GHSA-mwhf-vhr5-7j23 · Vendor Advisory
• https://github.com/Secreto31126/whatsapp-api-js/pull/371 · Patch
• https://github.com/Secreto31126/whatsapp-api-js/commit/56620c65126427496a94d176082fbd8393a95b6d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-45607 · Security Note
• https://osv.dev/vulnerability/GHSA-mwhf-vhr5-7j23 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45607 · Vendor Advisory
• https://github.com/Secreto31126/whatsapp-api-js · Note
• https://t.me/cvedetector/5523 · Telegram Post
• https://twitter.com/CVEnew/status/1834325372252365205 · Twitter Post
• https://t.me/cvenotify/95187 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1834362576890646602 · Twitter Post