Nanobot WebSocket Server Binding Vulnerability in WhatsApp Bridge Component Allowing Session Hijacking
Vulnerability
A vulnerability exists in the WhatsApp bridge component of Nanobot, where the WebSocket server is bound to all network interfaces on port 3001 by default. This server does not require authentication for incoming connections. As a result, an unauthenticated remote attacker with network access to the bridge can connect to the WebSocket server and hijack the associated WhatsApp session. This exploitation allows the attacker to send messages on behalf of the user, intercept all incoming messages and media in real-time, and capture authentication QR codes.
Impact
Exploitation of this vulnerability allows for complete hijacking of the linked WhatsApp session, enabling an attacker to send messages as the user, intercept incoming messages and media in real-time, and capture QR codes used for authentication.
Remediation
Users are advised to upgrade to Nanobot version 0.1.3.post7 or later.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.