CVE-2024-45607CWE-347

whatsapp-api-js fails to validate message's signature

Medium · published September 12, 2024

CVSS v3.1

5.8

EPSS

14%

Percentile

96.6

In the wild

Unconfirmed

What it is

whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature methods to handle messages is impacted. This vulnerability is fixed in 4.0.3.

The record

Technical detail

CVSS v3.1: 5.8 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.14468 · 96.6th percentile
Weakness: CWE-347 · Improper Verification of Cryptographic Signature
Published: 2024-09-12T19:58Z

EPSS history

Timeline

12 SEP 19:58Z
whatsapp-api-js fails to validate message's signature
cvelistv5