Wx Api
Monthly
Niefy wx-api through 0.8.2 allows unauthenticated remote attackers to impersonate WeChat followers by presenting a raw openid cookie to fan-facing controllers that Apache Shiro excludes from its authentication filter chain - specifically /wxUser/getUserInfo and /wxUserTags. Anyone who already knows a victim's openid can read that fan's nickname, phone number, unionid and tag assignments, and add or remove tags on the account, giving cross-tenant fan PII exposure and unauthorized state changes. Impact is bounded to per-fan confidentiality and integrity loss with no code execution or availability effect, and exploitation is non-trivial because openids are opaque, non-sequential identifiers, so blind mass exploitation is impractical without a prior source of valid openids; this is a moderate-priority issue with no public exploit identified at time of analysis, although a public technical writeup describing the attack path and an associated cross-tenant IDOR is referenced.
Niefy wx-api through 0.8.2 allows unauthenticated remote attackers to impersonate WeChat followers by presenting a raw openid cookie to fan-facing controllers that Apache Shiro excludes from its authentication filter chain - specifically /wxUser/getUserInfo and /wxUserTags. Anyone who already knows a victim's openid can read that fan's nickname, phone number, unionid and tag assignments, and add or remove tags on the account, giving cross-tenant fan PII exposure and unauthorized state changes. Impact is bounded to per-fan confidentiality and integrity loss with no code execution or availability effect, and exploitation is non-trivial because openids are opaque, non-sequential identifiers, so blind mass exploitation is impractical without a prior source of valid openids; this is a moderate-priority issue with no public exploit identified at time of analysis, although a public technical writeup describing the attack path and an associated cross-tenant IDOR is referenced.