| tiêu đề | zhayujie chatgpt-on-wechat (CowAgent) 2.0.4 Unauthenticated Channel Credential Injection |
|---|
| Mô tả | The POST /api/channels endpoint in chatgpt-on-wechat v2.0.4 Web Console allows an unauthenticated remote attacker to:
1.Inject arbitrary channel credentials (Feishu App Secret, DingTalk Client Secret, WeCom Secret, QQ App Secret, WeChat MP App Secret, AES Keys, Verification Tokens) into the application's config.json via the save action.
2.Activate new messaging channels and start network services on the server (binding to attacker-specified ports) via the connect action.
Both actions persist changes to disk and require zero authentication. This is a distinct vulnerability from the known /config POST endpoint (which writes to a different set of keys like open_ai_api_key and model).
|
|---|
| Nguồn | ⚠️ https://github.com/zhayujie/chatgpt-on-wechat/issues/2742 |
|---|
| Người dùng | York Shen (UID 97025) |
|---|
| Đệ trình | 02/04/2026 10:06 (cách đây 6 các tháng) |
|---|
| Kiểm duyệt | 12/04/2026 06:27 (10 days later) |
|---|
| Trạng thái | Bản sao |
|---|
| Mục VulDB | 356990 [zhayujie chatgpt-on-wechat CowAgent 2.0.4 Administrative HTTP Endpoint xác thực yếu] |
|---|
| điểm | 0 |
|---|