VYPR
← All advisories
Moderate severityNVD Advisory· Published Sep 12, 2024· Updated Sep 12, 2024

whatsapp-api-js fails to validate message's signature

CVE-2024-45607

Description

whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature methods to handle messages is impacted. This vulnerability is fixed in 4.0.3.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
whatsapp-api-jsnpm
>= 4.0.0, < 4.0.34.0.3

Affected products

1

Patches

1
56620c651264

Merge pull request #371 from felixarjuna/fix-verify-signature-double-negation

https://github.com/Secreto31126/whatsapp-api-jsTomás RaitiSep 6, 2024via ghsa
commit
2 files changed · +6 −2
  • src/index.ts+1 −1 modified
    @@ -976,7 +976,7 @@ export class WhatsAppAPI<EmittersReturnType = void> {
             .map((b) => b.toString(16).padStart(2, "0"))
             .join("");
 
-        return signature !== check;
+        return signature === check;
     }
 
     /**
  • test/index.test.cjs+5 −1 modified
    @@ -1629,7 +1629,11 @@ describe("WhatsAppAPI", function () {
 
                     it("should throw 401 if the signature doesn't match the hash", async function () {
                         await rejects(
-                            Whatsapp.post(valid_message_mock, body, "wrong"),
+                            Whatsapp.post(
+                                valid_message_mock,
+                                body,
+                                "sha256=wrong"
+                            ),
                             threw(401)
                         );
                     });

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.