Authorization Bypass in Chatify via Pusher Channel Manipulation

Executive Summary

Chatify before version 1.6.4 has an authorization bypass in the Pusher channel authorization endpoint. Authenticated users can subscribe to other users' private channels by providing arbitrary channel names. Attackers can request a signature for a victim's private channel via POST /chat/auth to intercept their incoming private messages and attachments in real time.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor POST requests to /chat/auth endpoints for unusual channel names like private-chatify.<victim id>. Check if any authenticated users are requesting signatures for channels not belonging to them. Review server logs for repeated failed authorization attempts or unexpected channel subscriptions.

Useful 0 Not Useful 0

Impact Analysis

If you use Chatify before 1.6.4, an attacker with your user ID can intercept your private messages and attachments in real time. This requires only an authenticated account and knowledge of your user ID, which may be easily obtainable. The impact is limited to messages received while the attacker is subscribed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to private messages, potentially violating data confidentiality requirements under GDPR and HIPAA. It may result in unauthorized disclosure of sensitive personal or health information, leading to compliance breaches and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to Chatify version 1.6.4 or later to patch the authorization bypass. If upgrading is not possible, restrict access to the /chat/auth endpoint and implement strict channel name validation to ensure users can only subscribe to their own private channels.

Useful 0 Not Useful 0