PT-2023-24825 · Microsoft · Windows Qrc Handler

Mason Corkern · Published 2023-07-14 · Updated 2023-07-26 · CVE-2023-3434

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jami version 20222284

Description The issue is related to improper input validation in hyperlink interpretation. This allows an attacker to send a custom HTML anchor tag to pass a string value to the Windows QRC Handler through the Jami messenger.

Recommendations For Jami version 20222284, consider disabling the hyperlink interpretation feature until a patch is available to prevent exploitation. Restrict access to the Windows QRC Handler to minimize the risk of passing malicious string values. Avoid using custom HTML anchor tags in the Jami messenger until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-3434

Affected Products

Windows Qrc Handler

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-3434 · Security Note
• https://review.jami.net/c/jami-client-qt/+/23569 · Patch
• https://osv.dev/vulnerability/CVE-2023-3434 · Vendor Advisory
• https://t.me/cvenotify/54371 · Telegram Post
• https://blog.blacklanternsecurity.com/p/Jami-Local-Denial-Of-Service-and-QRC-Handler-Vulnerabilities · Note
• https://git.jami.net/savoirfairelinux/jami-client-qt/-/wikis/Changelog#nightly-january-10 · Note