PT-2024-25540 · Telegram · Telegram Web K

Pedro Batista · Published 2024-04-28 · Updated 2024-07-03 · CVE-2024-33905

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Telegram WebK versions prior to 2.0.0 (488)

Description A Cross-Site Scripting (XSS) flaw in Telegram WebK allows attackers to gain full account access, potentially jeopardizing data and cryptowallets. The issue stems from the Mini App system and can be exploited via a malicious Mini Web App using the postMessage web app open link event type.

Recommendations For versions prior to 2.0.0 (488), update the web app to version 2.0.0 (488) or later for protection. As a temporary workaround, consider restricting the use of Mini Web Apps until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-33905

Affected Products

Telegram Web K

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-33905 · Security Note
• https://github.com/morethanwords/tweb/commit/2153ea9878668769faac8dd5931b7e0b96a9f129/src/components/popups/webApp.ts · Note
• https://twitter.com/vulmoncom/status/1785001777231794192 · Twitter Post
• https://medium.com/%40pedbap/telegram-web-app-xss-session-hijacking-1-click-95acccdc8d90 · Note
• https://t.me/cvenotify/78321 · Telegram Post
• https://twitter.com/socradar/status/1784966610551234579 · Twitter Post
• https://openwall.com/lists/oss-security/2024/04/28/4 · Note
• http://openwall.com/lists/oss-security/2024/04/30/4 · Note
• https://twitter.com/socradar/status/1784966529143951494 · Twitter Post
• https://twitter.com/CVEnew/status/1784823100695343189 · Twitter Post