Description
Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to read nickname, phone, unionid and tags, and add or remove fan tags.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
niefy wx-api
Default version status: unaffected
0 to ≤ 0.8.2affected
pkg:github/niefy/wx-apiReferences
- https://hackmd.io/@hieuPenguinnn/wx-api-cross-tenant-idor-and-unauth-fan-pii ↗
- https://github.com/niefy/wx-api/blob/0.8.2/src/main/java/com/github/niefy/modules/wx/controller/WxUserController.java#L31-L37 ↗
- https://github.com/niefy/wx-api/blob/0.8.2/src/main/java/com/github/niefy/modules/wx/controller/WxUserTagsController.java#L31-L45 ↗
- https://github.com/niefy/wx-api/blob/0.8.2/src/main/java/com/github/niefy/config/ShiroConfig.java#L43-L49 ↗
- https://www.vulncheck.com/advisories/niefy-wx-api-through-0.8.2-authentication-bypass-via-unverified-openid-cookie ↗