CVE-2023-43305: 
NixOS vulnerability analysis and mitigation

An issue was discovered in studio kent mini-app on Line v13.6.1 that exposes the channel access token to unauthorized actors. The vulnerability allows attackers to send crafted malicious notifications by exploiting the leaked channel access token (GitHub Report, NVD). The vulnerability was assigned CVE-2023-43305 and was disclosed in December 2023.

The vulnerability exists in the response of the request to 'www.l-members.me/miniapp/members_card', which exposes the critical channel access token in the response. The channel access token is used for securing communication within Line and should be kept secret. The vulnerability has been assigned a CVSS v3.1 base score of 8.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N (NVD).

The exposure of the channel access token allows attackers to broadcast malicious messages through the Line platform. This could lead to users receiving unauthorized notifications containing potentially harmful content such as malicious website links or fraudulent information. The vulnerability affects all users of the studio kent mini-app (GitHub Report).