CVE-2023-48133 in mini-app on Line
Summary
by MITRE • 01/26/2024
An issue in angel coffee mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/16/2025
The vulnerability identified as CVE-2023-48133 resides within the angel coffee mini-app running on Line platform version 13.6.1, presenting a critical security flaw that enables unauthorized notification injection attacks. This issue stems from improper handling of channel access tokens within the application's notification delivery mechanism, creating a pathway for malicious actors to exploit the system's communication infrastructure. The vulnerability represents a significant breach in the platform's security model as it allows attackers to leverage legitimate access tokens to send arbitrary notifications to users, effectively bypassing normal authentication and authorization controls that should protect the application's communication channels.
The technical implementation of this flaw involves the leakage of channel access tokens through insecure data handling practices within the mini-app's backend services. When the application processes notification requests, it fails to properly validate or sanitize the access token parameters, allowing attackers to inject malicious payloads through crafted notification messages. This vulnerability aligns with CWE-200, which addresses information exposure, and CWE-352, covering cross-site request forgery, as the access token leakage enables unauthorized manipulation of the notification system. The flaw essentially creates a vector where attackers can hijack the notification channel to deliver phishing content, malware distribution payloads, or social engineering attacks directly to users of the mini-app, exploiting the trust relationship between the Line platform and its applications.
The operational impact of CVE-2023-48133 extends beyond simple notification spamming to encompass sophisticated attack vectors that can compromise user trust and platform integrity. Attackers can leverage this vulnerability to conduct phishing campaigns disguised as legitimate notifications from the angel coffee service, potentially stealing user credentials or personal information. The vulnerability also enables the delivery of malicious payloads that could exploit other system vulnerabilities or create backdoor access points, as users may interact with the notifications and inadvertently execute harmful code. This threat landscape aligns with ATT&CK technique T1566, which covers phishing attacks, and T1071.004, covering application layer protocol traffic, as the attack exploits legitimate application communication channels to deliver malicious content.
Mitigation strategies for this vulnerability must address both the immediate token leakage issue and broader architectural security weaknesses within the Line platform's mini-app ecosystem. Organizations should implement strict access token rotation mechanisms and ensure that tokens are properly scoped to minimize the impact of any potential leakage. The application should enforce rigorous input validation and sanitization of all notification parameters, implementing proper authentication checks before processing any notification requests. Additionally, the platform should implement rate limiting and anomaly detection mechanisms to identify unusual notification patterns that may indicate exploitation attempts. Security measures should include regular token revocation procedures and enhanced monitoring of notification delivery patterns to detect unauthorized access to the communication channels. The vulnerability also necessitates a comprehensive review of the platform's API security model and implementation of proper cryptographic protection for all sensitive tokens and communication channels.