T05 · Unauthorized Access and Privilege Escalation
Error
- Location
weflow-proxy/main.go:11- Finding
Unauthenticated reverse proxy exposes private WeFlow data to the network
- Content
View full analysis
0 { for _, ip := range addrs { fmt.Printf("WeFlow API address: http://%s:%s\n", ip, "5032") } } else { fmt.Println("warning: no LAN addresses detected") } if err := http.ListenAndServe(listenAddr, handler); err != nil { log.Fatal(err) } } ``` ```go rp := &httputil.ReverseProxy{ Rewrite: func(r *httputil.ProxyRequest) { ctx := context.WithValue(r.Out.Context(), incomingHostKey, r.In.Host) r.Out = r.Out.WithContext(ctx) r.SetURL(target) }, } ``` The deployment instructions additionally tell the user to permit the proxy through Windows Firewall and then access it through the machine's LAN address. ### Technical Analysis The proxy listens on `0.0.0.0:5032`, making it reachable through every IPv4 network interface. It forwards arbitrary incoming HTTP requests to the loopback-only WeFlow service at `127.0.0.1:5031`. There is no authentication, authorization, client allowlist, route allowlist, or transport encryption. Consequently, the proxy removes the access boundary provided by the upstream service's loopback binding. The documented API includes endpoints for sessions, contacts, messages, and media, all of which may contain private WeChat information. Because the proxy accepts plain HTTP, requests and returned chat data are also vulnerable to observation or modification by an attacker positioned on the network path. ### Attack Path 1. The user starts `weflow-proxy` and allows TCP port 5032 through the local firewall as instructed. 2. An attacker on a rea ...[truncated 887 chars]- Remediation
View remediation