PT-2019-12254 · Electronic Arts+2 · Ea Origin+2

Daley Bee

+1

·

Publicado

2019-04-19

·

Atualizado

2022-04-18

·

CVE-2019-11354

CVSS v3.1

7.8

Alta

VetorAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions EA Origin version 10.5.36
Description The issue concerns template injection in the title parameter of the Origin2 URI handler, allowing an attacker to escape the AngularJS sandbox. This can lead to remote code execution via an origin2://game/launch URL, specifically affecting QtApplication QDesktopServices communication.
Recommendations For EA Origin version 10.5.36, consider restricting access to the origin2://game/launch URL until a patch is available. As a temporary workaround, avoid using the title parameter in the Origin2 URI handler to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2019-11354

Produtos afetados

Angularjs
Ea Origin
Qt