PT-2020-13255 · Ignite Realtime · Ignite Realtime Spark+1

4Nqr34Z + 1 · Published 2020-05-12 · Updated 2021-07-21 · CVE-2020-12772

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ignite Realtime Spark version 2.8.3

Description A issue was discovered where a chat message can include an IMG element with a SRC attribute referencing an external host's IP address. Upon access to this external host, the (NT)LM hashes of the user are sent with the HTTP request, allowing an attacker to collect these hashes, crack them, and potentially compromise the computer. This can occur if the user clicks on the message or if the ROAR plugin is configured for automatic access.

Recommendations For Ignite Realtime Spark version 2.8.3, consider disabling automatic access in the ROAR plugin to minimize the risk of exploitation. Restrict user interaction with chat messages that include external IMG elements until a fix is available.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2020-12772

Affected Products

Ignite Realtime Spark

Roar

References · 4

• 🔥 https://github.com/theart42/cves/blob/master/cve-2020-12772/CVE-2020-12772.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-12772 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12772 · Vendor Advisory
• https://t.me/cvenotify/3723 · Telegram Post