Executive Summary

This vulnerability exists in Capgo versions before 12.128.2 in the /functions/v1/channel_self endpoint. It allows unauthenticated attackers to send GET requests with arbitrary app_id parameters to the endpoint.

By doing so, attackers can enumerate non-public channel names, determine whether certain applications exist, and check subscription and billing status without needing authentication or device binding.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to information disclosure where attackers can learn about internal rollout channels, valid applications across tenants, and billing status.

This exposure can compromise confidentiality by revealing sensitive internal information to unauthorized parties, potentially aiding further attacks or unauthorized access.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unauthenticated GET requests to the /functions/v1/channel_self endpoint with arbitrary app_id parameters to enumerate non-public channel names and disclose information.

To detect this vulnerability on your network or system, you can monitor for unusual or unauthorized GET requests targeting the /functions/v1/channel_self endpoint, especially those containing varying app_id parameters.

Specific commands are not provided in the available information.

Useful 0 Not Useful 0

Mitigation Strategies

The provided information does not include specific mitigation steps.

However, as the vulnerability allows unauthenticated access to sensitive information, immediate mitigation could involve restricting access to the /functions/v1/channel_self endpoint, implementing authentication and authorization checks, and updating Capgo to version 12.128.2 or later where the vulnerability is fixed.

Useful 0 Not Useful 0