| タイトル | zhayujie chatgpt-on-wechat (CowAgent) 2.0.4 Unauthenticated Channel Credential Injection |
|---|
| 説明 | The POST /api/channels endpoint in chatgpt-on-wechat v2.0.4 Web Console allows an unauthenticated remote attacker to:
1.Inject arbitrary channel credentials (Feishu App Secret, DingTalk Client Secret, WeCom Secret, QQ App Secret, WeChat MP App Secret, AES Keys, Verification Tokens) into the application's config.json via the save action.
2.Activate new messaging channels and start network services on the server (binding to attacker-specified ports) via the connect action.
Both actions persist changes to disk and require zero authentication. This is a distinct vulnerability from the known /config POST endpoint (which writes to a different set of keys like open_ai_api_key and model).
|
|---|
| ソース | ⚠️ https://github.com/zhayujie/chatgpt-on-wechat/issues/2742 |
|---|
| ユーザー | York Shen (UID 97025) |
|---|
| 送信 | 2026年04月02日 10:06 (6 月 ago) |
|---|
| モデレーション | 2026年04月12日 06:27 (10 days later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 356990 [zhayujie chatgpt-on-wechat CowAgent 2.0.4 Administrative HTTP Endpoint 弱い認証] |
|---|
| ポイント | 0 |
|---|