Hikariatama

Name of the Vulnerable Software and Affected Versions: Hikka versions prior to 1.6.2 Description: A vulnerability in Hikka Telegram userbot allows an unauthenticated attacker to gain access to a victim's Telegram account and full access to the server. The issue affects all users of versions below 1.6.2, including most of the forks. Recommendations: For versions prior to 1.6.2, update to version 1.6.2 to patch the issue. As a temporary workaround, consider restricting access to sensitive features until the update is applied.

Name of the Vulnerable Software and Affected Versions: Hikka versions all Description: The issue affects all users on all versions of Hikka, a Telegram userbot. Two scenarios are possible: 1. If the web interface does not have an authenticated session, an attacker can use their own Telegram account to gain remote code execution (RCE) to the server by authorizing in the dangling web interface. 2. If the web interface does have an authenticated session, due to insufficient warning in the authentication message, users were tempted to click "Allow" in the "Allow web application ops" menu, giving an attacker access not only to RCE but also to Telegram accounts of owners. Scenario number 2 is known to have been exploited in the wild. Recommendations: Use the `--no-web` flag and do not start the userbot without it. After authorizing in the web interface, close the port on the server and/or start the userbot with the `--no-web` flag. Do not click "Allow" in your helper bot unless it is your explicit action that needs to be allowed.