CVE-2023-43302
📋 TL;DR
This vulnerability in the sanTas mini-app on Line v13.6.1 allows attackers to send malicious notifications by exploiting a leaked channel access token. Attackers can impersonate legitimate notifications to users. Only users of the affected Line version with the sanTas mini-app are impacted.
💻 Affected Systems
- Line mobile application
📦 What is this software?
Line by Linecorp
⚠️ Risk & Real-World Impact
Worst Case
Attackers could send phishing notifications to all users, potentially leading to credential theft, malware distribution, or financial fraud through impersonated legitimate communications.
Likely Case
Targeted users receive malicious notifications that could trick them into clicking malicious links or providing sensitive information.
If Mitigated
With proper token management and monitoring, impact is limited to notification spam that users can identify as suspicious.
🎯 Exploit Status
Exploitation requires obtaining the leaked channel access token first, but once obtained, sending malicious notifications is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Line v13.6.2 or later
Vendor Advisory: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-43302.md
Restart Required: Yes
Instructions:
1. Update Line app to v13.6.2 or later via official app stores. 2. Restart the application after update. 3. Verify update in app settings.
🔧 Temporary Workarounds
Disable sanTas mini-app
allRemove or disable the vulnerable sanTas mini-app from Line
Revoke and regenerate tokens
allIf managing Line channel, revoke compromised access tokens and generate new ones
🧯 If You Can't Patch
- Disable all mini-apps in Line settings to reduce attack surface
- Educate users to be suspicious of unexpected notifications and verify sender authenticity
🔍 How to Verify
Check if Vulnerable:
Check Line app version in settings - if v13.6.1 with sanTas mini-app installed, vulnerable.Check Version:
Not applicable - check via app settings UIVerify Fix Applied:
Confirm Line app version is v13.6.2 or later in app settings.📡 Detection & Monitoring
Log Indicators:
- Unusual notification patterns
- Multiple failed notification attempts
- Access token usage from unexpected sources
Network Indicators:
- Unexpected API calls to Line notification endpoints
- Traffic from unauthorized IPs to channel APIs
SIEM Query:
source="line_app" AND (event="notification_sent" AND user_agent NOT IN allowed_agents) OR (event="token_access" AND ip NOT IN allowed_ips)