T05 · Unauthorized Access and Privilege Escalation
Error
- Location
wechat_bridge.js:23- Finding
Unauthenticated Contact Enumeration and Arbitrary Message Sending
- Content
View full analysis
Vulnerability Details
File Location:
wechat_bridge.js, lines 23-71
Vulnerability Type: Missing authentication, missing authorization, and confirmation bypass
Risk Level: CriticalThe service exposes contact-discovery and message-sending routes without any authentication or authorization middleware.
javascript app.post('/wechat/dispatch', async (req, res) => { const { query, type, content, fileName } = req.body; try { const [friends, rooms] = await Promise.all([ wx('/wechatTool/queryFriend', 'GET', { name: query }), wx('/wechatTool/queryChatroom', 'GET') ]); let matches = [...(friends.data || [])]; if (rooms.data) { const roomMatches = rooms.data.filter(r => r.nickname.includes(query)); matches = matches.concat(roomMatches); } if (matches.length > 1) { return res.json({ status: "need_choice", data: matches.map(m => ({ name: m.nickname || m.remark, wxId: m.wxId })) }); } const target = matches[0]; res.json({ status: "confirm", target_id: target.wxId, target_name: target.nickname || target.remark, payload: { type, content, fileName } }); } catch (e) { res.status(500).json({ status: "error", msg: "service error" }); } }); app.post('/wechat/confirm_send', async (req, res) => { const { target_id, type, content, fileName } = req.body; const mapping = { text: { path: '/wechatTool/sendText', body: { contact: target_id, content } }, image: { path: '/wechatTool/sendImg', body: { contact: target_id, content } }, file: { path: '/wechatTool/sendFile', body: { contact: target_id, fileUrl: content, fileName } } }; const config = mapping[type]; const result = await wx(conf ...[truncated 2218 chars]- Remediation
View remediation
Remediation Suggestions
- Require strong authentication for every route, such as mutually authenticated TLS or signed, short-lived service credentials.
- Enforce server-side authorization that restricts which account, contacts, message types, and operations each caller may use.
- Replace the client-managed confirmation convention with a server-side pending transaction.
- After dispatch, issue a cryptographically random, short-lived, single-use confirmation token bound to the authenticated caller, target ID, message type, content digest, and file name.
- Require that token at
/wechat/confirm_sendand reject altered, expired, replayed, or already-consumed transactions. - Do not expose raw WeChat identifiers unless strictly required; return opaque, short-lived selection identifiers instead.
- Bind the service to a trusted interface and restrict port 3000 through firewall or service-mesh policy.
- Add rate limiting, replay protection, request-size limits, audit logging, and alerting for unusual enumeration or sending activity.
- Validate request bodies against a strict schema and allow only expected message types and payload formats.