Chatify
Monthly
Authorization bypass in Chatify, the Laravel live-chat package (munafio/chatify), before version 1.6.4 lets any authenticated user subscribe to another user's private inbox channel. By POSTing to the package's Pusher authorization endpoint (/chat/auth) with an arbitrary channel name of the form private-chatify.<victim id> and a socket id, an attacker obtains a valid Pusher signature and receives the victim's incoming private messages and attachments in real time. The victim's user id is a sequential integer, so enumeration is trivial; the only prerequisite is a valid account on the target instance (PR:L, network reachable, no user interaction) and the impact is confidentiality-only, with no message injection or tampering. A vendor fix exists in 1.6.4; no public exploit code was identified at time of analysis, although a technical writeup of the bypass is publicly available, and the issue is rated for remediation this week.
Authorization bypass in Chatify, the Laravel live-chat package (munafio/chatify), before version 1.6.4 lets any authenticated user subscribe to another user's private inbox channel. By POSTing to the package's Pusher authorization endpoint (/chat/auth) with an arbitrary channel name of the form private-chatify.<victim id> and a socket id, an attacker obtains a valid Pusher signature and receives the victim's incoming private messages and attachments in real time. The victim's user id is a sequential integer, so enumeration is trivial; the only prerequisite is a valid account on the target instance (PR:L, network reachable, no user interaction) and the impact is confidentiality-only, with no message injection or tampering. A vendor fix exists in 1.6.4; no public exploit code was identified at time of analysis, although a technical writeup of the bypass is publicly available, and the issue is rated for remediation this week.