PT-2017-16717 · Converse · Converse.Js

Published 2017-02-09 · Updated 2020-09-11 · CVE-2017-5858

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions converse.js versions 0.8.0 through 1.0.6 converse.js versions 2.0.0 through 2.0.4

Description The issue is related to an incorrect implementation of XEP-0280: Message Carbons in multiple XMPP clients, allowing a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This enables various kinds of social engineering attacks.

Recommendations If you're using converse.js 1.x, upgrade to 1.0.7 or later. If you're using converse.js 2.x, upgrade to 2.0.5 or later.

Exploit

Fix

Origin Validation Error

RCE

Weakness Enumeration

CWE-346

CWE-20

Related Identifiers

CVE-2017-5858

GHSA-W973-2QCC-P78X

Affected Products

Converse.Js

References · 12

• 🔥 http://openwall.com/lists/oss-security/2017/02/09/29 · Exploit
• 🔥 https://rt-solutions.de/wp-content/uploads/2017/02/CVE-2017-5589_xmpp_carbons.pdf · Exploit
• 🔥 https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons · Exploit
• https://github.com/jcbrand/converse.js/commit/42f249cabbbf5c026398e6d3b350f6f9536ea572 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-5858 · Security Note
• https://osv.dev/vulnerability/GHSA-w973-2qcc-p78x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-5858 · Vendor Advisory
• https://github.com/jcbrand/converse.js · Note
• https://snyk.io/vuln/SNYK-JS-CONVERSEJS-449664 · Note
• http://securityfocus.com/bid/96183 · Note
• https://openwall.com/lists/oss-security/2017/02/09/29 · Note
• https://npmjs.com/advisories/974 · Note