cnvd - cnvd-2018-10346

cnvd-2018-10346

Vulnerability from cnvd

Title: Open Whisper Signal跨站脚本漏洞

Description:

Open Whisper Signal（又名Signal-Desktop）是一款具有加密功能的即时聊天应用程序。

Open Whisper Signal 1.10.1及之前版本中存在跨站脚本漏洞，该漏洞源于程序未能过滤HTML元素。远程攻击者可通过发送消息利用该漏洞执行JavaScript代码。

Severity: 中

Patch Name: Open Whisper Signal跨站脚本漏洞的补丁

Patch Description:

Open Whisper Signal（又名Signal-Desktop）是一款具有加密功能的即时聊天应用程序。

Open Whisper Signal 1.10.1及之前版本中存在跨站脚本漏洞，该漏洞源于程序未能过滤HTML元素。远程攻击者可通过发送消息利用该漏洞执行JavaScript代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://github.com/signalapp/Signal-Desktop/compare/v1.11.0-beta.2%E2%80%A6development

Reference: https://nvd.nist.gov/vuln/detail/CVE-2018-11101

Impacted products

Name
Open Whisper Signal Open Whisper Signal（Signal-Desktop） <=1.10.1

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-11101",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2018-11101"
    }
  },
  "description": "Open Whisper Signal\uff08\u53c8\u540dSignal-Desktop\uff09\u662f\u4e00\u6b3e\u5177\u6709\u52a0\u5bc6\u529f\u80fd\u7684\u5373\u65f6\u804a\u5929\u5e94\u7528\u7a0b\u5e8f\u3002\r\n\r\nOpen Whisper Signal 1.10.1\u53ca\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u8fc7\u6ee4HTML\u5143\u7d20\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u53d1\u9001\u6d88\u606f\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884cJavaScript\u4ee3\u7801\u3002",
  "discovererName": "Unknow",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/signalapp/Signal-Desktop/compare/v1.11.0-beta.2%E2%80%A6development",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-10346",
  "openTime": "2018-05-28",
  "patchDescription": "Open Whisper Signal\uff08\u53c8\u540dSignal-Desktop\uff09\u662f\u4e00\u6b3e\u5177\u6709\u52a0\u5bc6\u529f\u80fd\u7684\u5373\u65f6\u804a\u5929\u5e94\u7528\u7a0b\u5e8f\u3002\r\n\r\nOpen Whisper Signal 1.10.1\u53ca\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u8fc7\u6ee4HTML\u5143\u7d20\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u53d1\u9001\u6d88\u606f\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884cJavaScript\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Open Whisper Signal\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Open Whisper Signal Open Whisper Signal\uff08Signal-Desktop\uff09 \u003c=1.10.1"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2018-11101",
  "serverity": "\u4e2d",
  "submitTime": "2018-05-21",
  "title": "Open Whisper Signal\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}

CVE-2018-11101 (GCVE-0-2018-11101)

Vulnerability from cvelistv5

Published

2018-05-17 19:00

Modified

2024-08-05 07:54

Severity ?

CWE

Summary

Open Whisper Signal (aka Signal-Desktop) through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnerability than CVE-2018-10994. The attacker needs to send HTML code directly as a message, and then reply to that message to trigger this vulnerability. The Signal-Desktop software fails to sanitize specific HTML elements that can be used to inject HTML code into remote chat windows when replying to an HTML message. Specifically the IMG and IFRAME elements can be used to include remote or local resources. For example, the use of an IFRAME element enables full code execution, allowing an attacker to download/upload files, information, etc. The SCRIPT element was also found to be injectable. On the Windows operating system, the CSP fails to prevent remote inclusion of resources via the SMB protocol. In this case, remote execution of JavaScript can be achieved by referencing the script on an SMB share within an IFRAME element, for example: <IFRAME src=\\DESKTOP-XXXXX\Temp\test.html> and then replying to it. The included JavaScript code is then executed automatically, without any interaction needed from the user. The vulnerability can be triggered in the Signal-Desktop client by sending a specially crafted message and then replying to it with any text or content in the reply (it doesn't matter).

References

▼	URL	Tags
	http://seclists.org/fulldisclosure/2018/May/46	mailing-list, x_refsource_FULLDISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:54:36.547Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20180516 CVE-2018-11101: Signal-desktop HTML tag injection variant 2",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2018/May/46"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-05-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Open Whisper Signal (aka Signal-Desktop) through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnerability than CVE-2018-10994. The attacker needs to send HTML code directly as a message, and then reply to that message to trigger this vulnerability. The Signal-Desktop software fails to sanitize specific HTML elements that can be used to inject HTML code into remote chat windows when replying to an HTML message. Specifically the IMG and IFRAME elements can be used to include remote or local resources. For example, the use of an IFRAME element enables full code execution, allowing an attacker to download/upload files, information, etc. The SCRIPT element was also found to be injectable. On the Windows operating system, the CSP fails to prevent remote inclusion of resources via the SMB protocol. In this case, remote execution of JavaScript can be achieved by referencing the script on an SMB share within an IFRAME element, for example: \u003cIFRAME src=\\\\DESKTOP-XXXXX\\Temp\\test.html\u003e and then replying to it. The included JavaScript code is then executed automatically, without any interaction needed from the user. The vulnerability can be triggered in the Signal-Desktop client by sending a specially crafted message and then replying to it with any text or content in the reply (it doesn\u0027t matter)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-05-18T04:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20180516 CVE-2018-11101: Signal-desktop HTML tag injection variant 2",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2018/May/46"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-11101",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Open Whisper Signal (aka Signal-Desktop) through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnerability than CVE-2018-10994. The attacker needs to send HTML code directly as a message, and then reply to that message to trigger this vulnerability. The Signal-Desktop software fails to sanitize specific HTML elements that can be used to inject HTML code into remote chat windows when replying to an HTML message. Specifically the IMG and IFRAME elements can be used to include remote or local resources. For example, the use of an IFRAME element enables full code execution, allowing an attacker to download/upload files, information, etc. The SCRIPT element was also found to be injectable. On the Windows operating system, the CSP fails to prevent remote inclusion of resources via the SMB protocol. In this case, remote execution of JavaScript can be achieved by referencing the script on an SMB share within an IFRAME element, for example: \u003cIFRAME src=\\\\DESKTOP-XXXXX\\Temp\\test.html\u003e and then replying to it. The included JavaScript code is then executed automatically, without any interaction needed from the user. The vulnerability can be triggered in the Signal-Desktop client by sending a specially crafted message and then replying to it with any text or content in the reply (it doesn\u0027t matter)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20180516 CVE-2018-11101: Signal-desktop HTML tag injection variant 2",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2018/May/46"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-11101",
    "datePublished": "2018-05-17T19:00:00",
    "dateReserved": "2018-05-14T00:00:00",
    "dateUpdated": "2024-08-05T07:54:36.547Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted