CVE-2023-43995: 
NixOS vulnerability analysis and mitigation

A vulnerability was discovered in the picot.golf mini-app on Line v13.6.1 that allows attackers to access and exploit the channel access token. The vulnerability was assigned CVE-2023-43995 and was disclosed in January 2024. The issue affects users of the Line application who access the picot.golf mini-app (GitHub Report).

The vulnerability is classified as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200). The issue stems from the exposure of the channel access token in the response of the request to 'www.l-members.me/miniapp/members_card'. The channel access token is a critical credential used for securing communication channels within Line and should be kept secret. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (NVD Database).

The vulnerability affects all users of the picot.golf mini-app on Line. When exploited, attackers can use the exposed channel access token to broadcast malicious messages through the Line platform, including potentially fraudulent information and malicious website links (GitHub Report).

The vulnerability is easily exploitable and only requires that the attacker has Line installed and can access the picot.golf mini-app. The exploit involves intercepting the response from the members_card endpoint, which exposes the channel access token. This token can then be used in the Authorization header for the Line messaging API (GitHub Report).