PT-2021-20161 · Overwolf · Overwolf Client

Joel Noguera · Published 2021-05-31 · Updated 2021-07-29 · CVE-2021-33501

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Overwolf Client version 0.169.0.22

Description The issue allows for XSS, resulting in Remote Code Execution, via an overwolfstore:// URL. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

Recommendations For Overwolf Client version 0.169.0.22, update to a version that fixes the XSS vulnerability to prevent Remote Code Execution via overwolfstore:// URLs. As a temporary workaround, consider restricting access to overwolfstore:// URLs until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-33501

Affected Products

Overwolf Client

References · 14

• 🔥 https://github.com/swordbytes/Advisories/blob/master/2021/Advisory_CVE-2021-33501.pdf · Exploit
• 🔥 https://swordbytes.com/blog/security-advisory-overwolf-1-click-remote-code-execution-cve-2021-33501 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-33501 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33501 · Vendor Advisory
• https://t.me/cvenotify/18336 · Telegram Post
• https://t.me/secharvester/11080 · Telegram Post
• https://t.me/defcon_news/77422 · Telegram Post
• https://t.me/thebugbountyhunter/5429 · Telegram Post
• https://t.me/malwr/5113 · Telegram Post
• https://t.me/rnetsec/15039 · Telegram Post
• https://overwolf.com · Note
• https://t.me/pentestingnews/4002 · Telegram Post
• https://t.me/cvenotify/18312 · Telegram Post
• https://t.me/cibsecurity/26248 · Telegram Post