Sipeed PicoClaw Authentication Bypass Vulnerability in LINE Webhook Component

An authentication bypass vulnerability has been identified in Sipeed PicoClaw versions through 0.2.9, specifically within the LINE webhook component. The issue arises in the 'webhook.ParseRequest' function of 'pkg/channels/line/line.go', where the webhook handler validates the HMAC signature but fails to suppress duplicate events. This flaw allows an attacker to replay previously valid LINE webhooks, causing the same event to be processed multiple times. The vulnerability can be exploited remotely, leading to unintended duplicate actions within the application.

Impact

Exploitation of this vulnerability allows for the capture and replay of LINE webhook events, causing duplicate processing of these events within PicoClaw. This can disrupt normal operations by repeating actions associated with the webhooks, such as sending messages or triggering responses, without any indication of duplication. The lack of proper replay protection and idempotency in handling these webhooks can result in unnecessary resource usage and costs, especially if the repeated actions involve paid services or APIs.

Reproduction

To reproduce this vulnerability, first ensure that Sipeed PicoClaw version 0.2.9 or earlier is running. The LINE channel must be enabled and configured to accept webhooks. Once this setup is complete, capture a valid LINE webhook delivery that includes the necessary signature. After capturing the webhook, it can be replayed to the PicoClaw webhook endpoint. The webhook handler will process the event and acknowledge receipt with a '200 OK' response. This can be verified by checking the internal event processing logs, which will show that the same message ID has been handled multiple times, indicating successful exploitation of the vulnerability.

Remediation

Users can update to Sipeed PicoClaw version 0.2.10 or later, where this vulnerability has been addressed.