Xianyu Auto Reply Fix
Monthly
Missing authorization in the POST /send-message endpoint of xianyu-auto-reply-fix through 2.0.7 lets unauthenticated remote attackers send arbitrary Xianyu messages to buyers from another merchant's account by supplying a published default/test API secret plus that account's cookie_id along with chosen chat_id, to_user_id and message values. Exploitation is gated by three conditions: the endpoint must be reachable, the instance must still be running a pre-patch build with the send secret unset or left at one of the published defaults ('xianyu_qq_reply_2024', 'xianyu_api_secret_2024', 'zhinina_test_key'), and the attacker must know a valid account-specific cookie_id, which limits mass exploitation. Impact is confined to message integrity - no data is read and no code is executed - yielding an assessed CVSS 3.1 score of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N; no public exploit code has been identified at time of analysis, and the vendor has published an upstream fix commit.
Missing authorization in the POST /send-message endpoint of xianyu-auto-reply-fix through 2.0.7 lets unauthenticated remote attackers send arbitrary Xianyu messages to buyers from another merchant's account by supplying a published default/test API secret plus that account's cookie_id along with chosen chat_id, to_user_id and message values. Exploitation is gated by three conditions: the endpoint must be reachable, the instance must still be running a pre-patch build with the send secret unset or left at one of the published defaults ('xianyu_qq_reply_2024', 'xianyu_api_secret_2024', 'zhinina_test_key'), and the attacker must know a valid account-specific cookie_id, which limits mass exploitation. Impact is confined to message integrity - no data is read and no code is executed - yielding an assessed CVSS 3.1 score of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N; no public exploit code has been identified at time of analysis, and the vendor has published an upstream fix commit.