CVE-2026-4984: botpress, CSRF

Описание

Оригинално описание

The Twilio integration webhook handler accepts any POST request without validating Twilio's 'X-Twilio-Signature'. When processing media messages, it fetches user-controlled URLs ('MediaUrlN' parameters) using HTTP requests that include the integration's Twilio credentials in the 'Authorization' header. An attacker can forge a webhook payload pointing to their own server and receive the victim's 'accountSID' and 'authToken' in plaintext (base64-encoded Basic Auth), leading to full compromise of the Twilio account.

Засегнати продукти

• botpress botpress: 0

Вид слабост

• CWE-345 Недостатъчна проверка на автентичността на данните
• CWE-352 CSRF

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-4984
• https://nvd.nist.gov/vuln/detail/CVE-2026-4984
• https://www.tenable.com/security/research/tra-2026-22