CVE-2023-43998: 
NixOS vulnerability analysis and mitigation

An issue was discovered in the Books-futaba mini-app on Line v13.6.1 that exposes the channel access token to client-side users. The vulnerability allows attackers to access sensitive authentication credentials that should be kept secret (GitHub Report). The vulnerability was assigned CVE-2023-43998 and has been classified with a CVSS v3.1 Base Score of 5.4 (MEDIUM) (NVD).

The vulnerability exists in the response of the request to 'www.l-members.me/miniapp/members_card', which exposes the channel access token. This token is used for securing communication channels within Line and should be strictly protected. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, indicating network accessibility with low attack complexity (GitHub Report, NVD).

The exposure of the channel access token allows attackers to potentially broadcast malicious messages through the Line platform. Any user of the Books-futaba mini-app could be affected, potentially receiving malicious broadcast messages containing fraudulent information or malicious website links (GitHub Report).

The vulnerability is easily exploitable and only requires that the client has Line installed and opens the Books-futaba mini-app. The attacker can then capture the channel access token from the response of the members_card request, which can be used to send unauthorized notifications (GitHub Report).