Description
evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version, database client name, configured server URL, and WhatsApp instance details.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| evolution-foundation | evolution-api | ≤ 2.3.7 | — |
References
- Researcher write-up third-party-advisory exploit
- metricsIPWhitelist middleware at 2.3.7 technical-description
- https://github.com/evolution-foundation/evolution-api product
- VulnCheck Advisory: evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass third-party-advisory