CVE-2023-43304
📋 TL;DR
This vulnerability in the PARK DANDAN mini-app on Line v13.6.1 allows attackers to send malicious notifications by exploiting a leaked channel access token. Attackers can impersonate legitimate notifications to users. This affects users of the PARK DANDAN mini-app within the Line messaging platform.
💻 Affected Systems
- Line
- PARK DANDAN mini-app
📦 What is this software?
Line by Linecorp
⚠️ Risk & Real-World Impact
Worst Case
Attackers could send phishing notifications to all users, potentially stealing credentials, spreading malware, or conducting social engineering attacks at scale.
Likely Case
Attackers send spam or phishing notifications to users, potentially leading to credential theft or malware installation.
If Mitigated
With proper token management and validation, unauthorized notification sending is prevented, limiting impact to notification spam.
🎯 Exploit Status
Exploitation requires obtaining the leaked channel access token, which may be available through misconfiguration or other vulnerabilities.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Line v13.6.2 or later
Vendor Advisory: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-43304.md
Restart Required: Yes
Instructions:
1. Update Line app to v13.6.2 or later via official app stores. 2. Ensure PARK DANDAN mini-app is updated if available. 3. Restart the app after update.
🔧 Temporary Workarounds
Disable PARK DANDAN mini-app
allRemove or disable the vulnerable mini-app from Line to prevent exploitation.
Revoke and regenerate access tokens
allIf you manage the mini-app, revoke leaked tokens and generate new ones with proper security controls.
🧯 If You Can't Patch
- Monitor for unusual notification activity and user reports of spam/phishing.
- Implement network filtering to block malicious notification sources if detectable.
🔍 How to Verify
Check if Vulnerable:
Check Line app version in settings; if v13.6.1 and PARK DANDAN mini-app is installed, you are vulnerable.Check Version:
Not applicable; check via app settings on mobile device.Verify Fix Applied:
Update Line to v13.6.2 or later and verify version in app settings.📡 Detection & Monitoring
Log Indicators:
- Unusual notification send events in app logs
- Failed authentication attempts for notification APIs
Network Indicators:
- Unexpected outbound traffic to notification services
- Anomalous patterns in API calls to Line servers
SIEM Query:
Not applicable for typical user environments; for enterprise monitoring, look for spikes in notification-related network traffic.