OneBlog v2.3.9 Unauthorized Access to WeChat Sensitive Tokens (CVE-like) POC

Vulnerability Overview Vulnerability Title: OneBlog v2.3.9 — Unauthorized Access to WeChat Official Account Sensitive Tokens #43 Vulnerability Type: Missing Authentication for Critical Function / Sensitive Information Exposure Affected Versions: OneBlog v2.3.9 Severity: High (CVSS 3.1 Score: 7.5) Attack Vector: Remote, Unauthenticated Vulnerability Description: The frontend module ( ) of OneBlog exposes a WeChat JS-SDK signature endpoint , which is intended to generate signatures for frontend JS-SDK integration. This endpoint contains the following critical security flaws: 1. The module does not have an authentication framework configured. 2. The endpoint method lacks authorization annotations. 3. The endpoint directly returns raw and to the caller. Impact Scope Leaked Credentials and Capabilities: - access_token: Valid for 2 hours; can be used to broadcast messages, retrieve follower lists, manage custom menus, access user information, create tags, upload media, send customer service messages, and more. - jsapi_ticket: Valid for 2 hours; can be used to construct valid JS-SDK signatures to spoof frontend WeChat functionalities. - appid: Permanent validity; used in conjunction with . Potential Damage: 1. Official Account Impersonation: Attackers can use the leaked to send malicious messages in the name of the official account. 2. User Data Theft: Attackers can obtain follower lists, user personal information, and other sensitive data. 3. Menu Tampering: Attackers can modify custom menus to redirect users to phishing pages. 4. Content Manipulation: Attackers can upload or delete the official account's media assets (articles, images, etc.). 5. Customer Service Abuse: Attackers can send unauthorized customer service messages to followers. Impact Scope: - OneBlog v2.3.9 and earlier versions. - Any OneBlog instance configured with WeChat Official Account functionality. - Instances without WeChat configuration are not affected. Remediation Immediate Remediation (Recommended) Option A: Remove and from the response - Frontend JS-SDK initialization only requires the signature, timestamp, nonceStr, and URL. All token retrieval and signature computation should be performed on the server side, returning only the signature result. Option B: Add authentication to the module - Register an authentication interceptor in 's , requiring user authentication for sensitive endpoints such as . Long-term Remediation 1. Unified Authentication Architecture: Apply Apache Shiro (or an equivalent system) to both the and modules. 2. Principle of Least Privilege: All endpoints handling sensitive credentials must enforce authentication and authorization checks. 3. Secure Credential Management: Cache on the server side to avoid repeated token requests, thereby reducing the exposure window. POC Code Technical Root Cause Analysis Architectural Context: OneBlog uses a dual-module independent deployment architecture. The module is configured with a complete Shiro authentication system, while the module only has rate limiting configured and lacks authentication interceptors. Root Cause: The module lacks Shiro configuration, resulting in the absence of authentication protection for sensitive endpoints. Vulnerable Code Location: - File: - Method: Conclusion This vulnerability allows a remote unauthenticated attacker to obtain sensitive credentials for the WeChat Official Account, potentially leading to severe consequences such as account impersonation, data theft, menu tampering, content manipulation, and customer service abuse. It is recommended to implement the aforementioned remediation measures immediately to mitigate the risk.

Goal Reached Thanks to every supporter — we hit 100%!

OneBlog v2.3.9 Unauthorized Access to WeChat Sensitive Tokens (CVE-like) POC

More from this source