GHSA-mwhf-vhr5-7j23MediumCVSS 5.8

whatsapp-api-js fails to validate message's signature

Published
September 12, 2024
Last Modified
September 12, 2024

🔗 CVE IDs covered (1)

CVE-2024-45607 →

📋 Description

Impact

Incorrect Access Control, anyone using the post or verifyRequestSignature methods to handle messages is impacted.

Patches

Patched in version 4.0.3.

Workarounds

It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid.

function doPost(payload, header_signature) {
    if (whatsapp.verifyRequestSignature(payload.toString(), header_signature) {
        throw 403;
    }
    
    // Now the payload is correctly verified
    whatsapp.post(payload);
}

References

https://github.com/Secreto31126/whatsapp-api-js/pull/371

🎯 Affected products1

  • npm/whatsapp-api-js:>= 4.0.0, < 4.0.3

🔗 References (5)