| शीर्षक | zhayujie chatgpt-on-wechat (CowAgent) 2.0.4 Unauthenticated Channel Credential Injection |
|---|
| विवरण | The POST /api/channels endpoint in chatgpt-on-wechat v2.0.4 Web Console allows an unauthenticated remote attacker to:
1.Inject arbitrary channel credentials (Feishu App Secret, DingTalk Client Secret, WeCom Secret, QQ App Secret, WeChat MP App Secret, AES Keys, Verification Tokens) into the application's config.json via the save action.
2.Activate new messaging channels and start network services on the server (binding to attacker-specified ports) via the connect action.
Both actions persist changes to disk and require zero authentication. This is a distinct vulnerability from the known /config POST endpoint (which writes to a different set of keys like open_ai_api_key and model).
|
|---|
| स्रोत | ⚠️ https://github.com/zhayujie/chatgpt-on-wechat/issues/2742 |
|---|
| उपयोगकर्ता | York Shen (UID 97025) |
|---|
| सबमिशन | 02/04/2026 10:06 AM (6 महीनों पहले) |
|---|
| संयम | 12/04/2026 06:27 AM (10 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 356990 [zhayujie chatgpt-on-wechat CowAgent 2.0.4 Administrative HTTP Endpoint कमजोर प्रमाणीकरण] |
|---|
| अंक | 0 |
|---|