PT-2022-19426 · Unknown+1 · Wire-Webapp+3

Markus Vervier · Published 2022-06-25 · Updated 2022-07-11 · CVE-2022-29168

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wire versions prior to 2022-05-04-production.0 Wire-server versions prior to 2022-05-04 (chart/4.11.0)

Description The issue concerns arbitrary HTML and Javascript execution via insufficient escaping when rendering @mentions in the wire-webapp. If a user receives and views a malicious message, arbitrary code is injected and executed in the context of the victim, allowing the attacker to fully control the user account. Wire-desktop clients connected to a vulnerable wire-webapp version are also vulnerable to this attack.

Recommendations For wire-webapp versions prior to 2022-05-04-production.0, update to docker tag 2022-05-04-production.0-v0.29.7-0-a6f2ded or later. For wire-server versions prior to 2022-05-04 (chart/4.11.0), update to version 2022-05-04 (chart/4.11.0) or later. As a temporary workaround, consider disabling the rendering of @mentions in the wire-webapp until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2022-29168

GHSA-JGV3-4J56-FVH6

Affected Products

Wire

Wire-Desktop

Wire-Server

Wire-Webapp

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29168.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-29168 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29168 · Vendor Advisory
• https://github.com/wireapp/wire-webapp/security/advisories/GHSA-jgv3-4j56-fvh6 · Note
• https://t.me/cvenotify/32876 · Telegram Post
• https://t.me/cvenotify/32183 · Telegram Post