Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1td2hmLXZocjUtN2oyM84AA_gO

whatsapp-api-js fails to validate message's signature

Impact

Incorrect Access Control, anyone using the post or verifyRequestSignature methods to handle messages is impacted.

Patches

Patched in version 4.0.3.

Workarounds

It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid.

function doPost(payload, header_signature) {
    if (whatsapp.verifyRequestSignature(payload.toString(), header_signature) {
        throw 403;
    }
    
    // Now the payload is correctly verified
    whatsapp.post(payload);
}

References

https://github.com/Secreto31126/whatsapp-api-js/pull/371

Permalink: https://github.com/advisories/GHSA-mwhf-vhr5-7j23
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1td2hmLXZocjUtN2oyM84AA_gO
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 2 months ago
Updated: 2 months ago

CVSS Score: 5.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Identifiers: GHSA-mwhf-vhr5-7j23, CVE-2024-45607
References:

• https://github.com/Secreto31126/whatsapp-api-js/security/advisories/GHSA-mwhf-vhr5-7j23
• https://github.com/Secreto31126/whatsapp-api-js/pull/371
• https://github.com/Secreto31126/whatsapp-api-js/commit/56620c65126427496a94d176082fbd8393a95b6d
• https://nvd.nist.gov/vuln/detail/CVE-2024-45607
• https://github.com/advisories/GHSA-mwhf-vhr5-7j23

Repository: https://github.com/Secreto31126/whatsapp-api-js
Blast Radius: 5.8

Affected Packages