| 제목 | zhayujie chatgpt-on-wechat (CowAgent) 2.0.4 Unauthenticated Channel Credential Injection |
|---|
| 설명 | The POST /api/channels endpoint in chatgpt-on-wechat v2.0.4 Web Console allows an unauthenticated remote attacker to:
1.Inject arbitrary channel credentials (Feishu App Secret, DingTalk Client Secret, WeCom Secret, QQ App Secret, WeChat MP App Secret, AES Keys, Verification Tokens) into the application's config.json via the save action.
2.Activate new messaging channels and start network services on the server (binding to attacker-specified ports) via the connect action.
Both actions persist changes to disk and require zero authentication. This is a distinct vulnerability from the known /config POST endpoint (which writes to a different set of keys like open_ai_api_key and model).
|
|---|
| 원천 | ⚠️ https://github.com/zhayujie/chatgpt-on-wechat/issues/2742 |
|---|
| 사용자 | York Shen (UID 97025) |
|---|
| 제출 | 2026. 04. 02. AM 10:06 (6 개월 ago) |
|---|
| 모더레이션 | 2026. 04. 12. AM 06:27 (10 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 356990 [zhayujie chatgpt-on-wechat CowAgent 2.0.4 Administrative HTTP Endpoint 약한 인증] |
|---|
| 포인트들 | 0 |
|---|