medium5.8
CVE-2024-45607
whatsapp-api-js fails to validate message's signature
Impact
### Impact Incorrect Access Control, anyone using the post or verifyRequestSignature methods to handle messages is impacted. ### Patches Patched in version 4.0.3. ### Workarounds It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. ```ts function doPost(payload, header_signature) { if (whatsapp.verifyRequestSignature(payload.toString(), header_signature) { throw 403; } // Now the payload is correctly verified whatsapp.post(payload); } ``` ### References https://github.com/Secreto31126/whatsapp-api-js/pull/371
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | whatsapp-api-js | >= 4.0.0, < 4.0.3 | 4.0.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Secreto31126 | Whatsapp-Api-Js | from 4.0.0 before 4.0.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/Secreto31126/whatsapp-api-js/commit/56620c65126427496a94d176082fbd8393a95b6d
- https://github.com/Secreto31126/whatsapp-api-js/pull/371
- https://github.com/Secreto31126/whatsapp-api-js/security/advisories/GHSA-mwhf-vhr5-7j23
- https://github.com/advisories/GHSA-mwhf-vhr5-7j23
- https://nvd.nist.gov/vuln/detail/CVE-2024-45607