Moderate severityNVD Advisory· Published Sep 12, 2024· Updated Sep 12, 2024
whatsapp-api-js fails to validate message's signature
CVE-2024-45607
Description
whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature methods to handle messages is impacted. This vulnerability is fixed in 4.0.3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
whatsapp-api-jsnpm | >= 4.0.0, < 4.0.3 | 4.0.3 |
Affected products
2- Range: >= 4.0.0, < 4.0.3
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-mwhf-vhr5-7j23ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-45607ghsaADVISORY
- github.com/Secreto31126/whatsapp-api-js/commit/56620c65126427496a94d176082fbd8393a95b6dghsax_refsource_MISCWEB
- github.com/Secreto31126/whatsapp-api-js/pull/371ghsax_refsource_MISCWEB
- github.com/Secreto31126/whatsapp-api-js/security/advisories/GHSA-mwhf-vhr5-7j23ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.