PT-2021-7421 · Keybase · Keybase Client For Windows

M4T35Z · Published 2021-11-09 · Updated 2021-11-16 · CVE-2021-34422

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keybase Client for Windows versions prior to 5.7.0

Description The issue is related to a path traversal vulnerability when checking the name of a file uploaded to a team folder. A malicious user could upload a file to a shared folder with a specially crafted file name, potentially allowing a user to execute an application not intended on their host machine. This could lead to remote code execution, especially if the public folder sharing feature of the Keybase client is exploited.

Recommendations For versions prior to 5.7.0, update to version 5.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to shared folders and limiting the ability to upload files with specially crafted names until the update is applied.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2022-06097

CVE-2021-34422

Affected Products

Keybase Client For Windows

References · 6

• https://explore.zoom.us/en/trust/security/security-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34422 · Security Note
• https://bdu.fstec.ru/vul/2022-06097 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34422 · Vendor Advisory
• https://t.me/cibsecurity/32268 · Telegram Post
• https://t.me/true_secator/2322 · Telegram Post