PT-2022-8609 · Apple · Imessage

Zadewg · Published 2022-03-23 · Updated 2022-03-30 · CVE-2020-20095

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions iMessage (Messages app) versions prior to 12.4

Description The user interface of the iMessage app does not properly represent URI messages to the user. This results in URI spoofing via specially crafted messages.

Recommendations For versions prior to 12.4, update to a version newer than 12.4 to resolve the issue. As a temporary workaround, consider avoiding the use of URI messages in the iMessage app until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2020-20095

Affected Products

Imessage

References · 9

• 🔥 https://github.com/zadewg/RIUS · Exploit
• 🔥 http://packetstormsecurity.com/files/166448/RTLO-Injection-URI-Spoofing.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-20095 · Security Note
• https://osv.dev/vulnerability/CVE-2020-20095 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/5699 · Telegram Post
• https://t.me/s_e_reborn/2017 · Telegram Post
• https://t.me/true_secator/2779 · Telegram Post
• https://t.me/cibsecurity/39462 · Telegram Post
• https://t.me/pentestingnews/20964 · Telegram Post