PT-2021-23090 · Unknown · Wire-Server

Arianvp + 1 · Published 2021-09-30 · Updated 2021-10-08 · CVE-2021-41101

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions wire-server versions prior to 2.106.0

Description The issue concerns the CORS Access-Control-Allow-Origin header set by nginz for all subdomains of .wire.com, including wire.com. This configuration allows an attacker to exploit an XSS vector in any subdomain to access the Wire API using the user's Cookie.

Recommendations To mitigate the issue, limit the Access-Control-Allow-Origin header to apps that actually require the cookie, such as account-pages, team-settings, and the webapp. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-41101

GHSA-V7XX-CX8M-G66P

Affected Products

Wire-Server

References · 6

• https://osv.dev/vulnerability/CVE-2021-41101 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41101 · Security Note
• https://github.com/wireapp/wire-server/security/advisories/GHSA-v7xx-cx8m-g66p · Note
• https://t.me/cvenotify/22120 · Telegram Post
• https://t.me/cvenotify/21703 · Telegram Post
• https://t.me/cibsecurity/29764 · Telegram Post