PT-2022-16887 · Wire · Wire-Server+2

Posix · Published 2022-04-20 · Updated 2022-05-03 · CVE-2022-24799

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wire-webapp versions prior to 2022-03-30-production.0

Description The issue is related to insufficient escaping in markdown "code highlighting" in the wire-webapp, which allows the possibility of injecting and executing arbitrary HTML code and thus also JavaScript. If a user receives and views a malicious message, arbitrary code is injected and executed in the context of the victim, allowing the attacker to fully control the user account. Wire-desktop clients connected to a vulnerable wire-webapp version are also vulnerable to this attack.

Recommendations For wire-webapp versions prior to 2022-03-30-production.0, update to docker tag 2022-03-30-production.0-v0.29.2-0-d144552 or wire-server 2022-03-30 (chart/4.8.0) to resolve the issue. As a temporary workaround, consider restricting access to the markdown "code highlighting" feature until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-24799

GHSA-5568-RFH8-VMHQ

Affected Products

Wire-Desktop

Wire-Server

Wire-Webapp

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24799.json · Exploit
• https://github.com/wireapp/wire-webapp/commit/d14455252a949dc83f36d45e2babbdd9328af2a4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24799 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24799 · Vendor Advisory
• https://github.com/wireapp/wire-webapp/releases/tag/2022-03-30-production.0 · Note
• https://github.com/wireapp/wire-webapp/security/advisories/GHSA-5568-rfh8-vmhq · Note
• https://t.me/cibsecurity/41194 · Telegram Post