PT-2021-14474 · Wire · Wire-Server

Raphaelrobert · Published 2021-03-26 · Updated 2021-08-27 · CVE-2021-21396

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions wire-server versions 2021-02-16 through 2021-03-02

Description The client metadata of all users was exposed in the "GET /users/list-clients" endpoint. This endpoint could be used by any logged-in user to request client details of any other user, as long as they could find their User ID. The exposed metadata included id, class, type, location, time, and cookie. A user on a Wire backend could use this endpoint to find registration time and location for each device for a given list of users.

Recommendations For versions 2021-02-16 through 2021-03-02, update to version 2021-03-02 to resolve the issue. As a temporary workaround, consider removing "/list-clients" from the nginx config to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-21396

GHSA-QX8Q-RHQ2-RG4J

Affected Products

Wire-Server

References · 10

• https://github.com/wireapp/wire-server/security/advisories/GHSA-qx8q-rhq2-rg4j · Patch
• https://github.com/wireapp/wire-server/commit/7ba2bf4140282557cf215e0b2c354d4d08cd3421 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-21396 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21396 · Vendor Advisory
• https://github.com/wireapp/wire-server/releases/tag/v2021-03-02 · Note
• https://t.me/cvenotify/12147 · Telegram Post
• https://t.me/cvenotify/12123 · Telegram Post
• https://t.me/cvenotify/20259 · Telegram Post
• https://t.me/cvenotify/12192 · Telegram Post
• https://t.me/cvenotify/12171 · Telegram Post