Vulnerability in niefy wx-api

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid cookie to fan-facing controllers. Attackers knowing a victim's openid can call /wxUser/getUserInfo and /wxUserTags endpoints to read nickname, phone, unionid and tags, and add or remove fan tags.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/niefy/wx-api/blob/0.8.2/src/main/java/com/github/niefy/config/ShiroConfig.java
• github.com/niefy/wx-api/blob/0.8.2/src/main/java/com/github/niefy/modules/wx/controller…
• github.com/niefy/wx-api/blob/0.8.2/src/main/java/com/github/niefy/modules/wx/controller…
• hackmd.io/@hieuPenguinnn/wx-api-cross-tenant-idor-and-unauth-fan-pii
• www.vulncheck.com/advisories/niefy-wx-api-through-0.8.2-authentication-bypass-via-unver…