Gửi #847484: zhayujie chatgpt-on-wechat / CowAgent 2.1.0 Missing Authentication for Critical Function (CWE-306)

# Technical Details
An authentication bypass exists in the `[verify_server]` method in `channel/wechatmp/common.py` of chatgpt-on-wechat / CowAgent.

The application fails to enforce a non-empty `wechatmp_token` for WeChat MP webhook signature verification. Because the shipped default token is the empty string, attackers can compute valid signatures offline and pass `/wx` verification without access to the real WeChat platform.

# Vulnerable Code
File: `channel/wechatmp/common.py`, `config.py`, `channel/wechatmp/wechatmp_channel.py`
Method: `verify_server`, default config initialization, `WechatMPChannel.startup`
Why: `verify_server()` reads `conf().get("wechatmp_token")` directly, while `config.py` ships `"wechatmp_token": ""`. The callback listener is exposed publicly, so a forged request with SHA-1 calculated using the empty token is accepted as authentic.

# Reproduction
1. Enable the `wechatmp` channel with an empty `wechatmp_token` and expose the `/wx` callback endpoint.
2. Choose any `timestamp` and `nonce`, compute the matching SHA-1 signature using the empty token, and send a forged `POST /wx` XML request.
3. Observe the vulnerable deployment return HTTP 200 and process the message, while a control deployment with `wechatmp_token="lab-secure-token"` returns HTTP 403 with `InvalidSignatureException`.

# Impact
- Unauthenticated remote attackers can impersonate the WeChat platform and inject arbitrary webhook messages.
- This can trigger unauthorized chat actions, workflow abuse, context poisoning, and downstream bot or agent execution.

• Nguồn: ⚠️ https://github.com/zhayujie/CowAgent/issues/2860
• Người dùng: Eric-j (UID 98073)
• Đệ trình: 04/06/2026 08:16 (cách đây 1 tháng)
• Kiểm duyệt: 04/07/2026 09:44 (1 month later)
• Trạng thái: được chấp nhận
• Mục VulDB: 376304 [zhayujie chatgpt-on-wechat CowAgent 2.1.0 wx Endpoint common.py verify_server wechatmp_token xác thực yếu]
• điểm: 20