PT-2024-5251 · Telegram · Telegram For Android

Lukas Stefanko · Published 2024-06-26 · Updated 2026-02-09 · CVE-2024-7014

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Telegram for Android versions 10.14.4 and older Telegram for Android version 11.7.4

Description The issue is related to the incorrect handling of file extensions in received files, allowing an attacker to send malicious apps disguised as videos. This can lead to the execution of arbitrary code on the user's device. The vulnerability is exploited by creating a specially crafted HTML file that is misinterpreted by Telegram as a valid video file. When a user attempts to play one of these crafted "videos", Telegram offers to open the file in an external application, potentially leading to the installation of malicious software. The estimated number of potentially affected devices is not specified.

Recommendations For versions 10.14.4 and older, consider disabling the video playback feature in Telegram until a patch is available. For version 11.7.4, restrict access to the video handling module to minimize the risk of exploitation. As a temporary workaround, avoid using the Telegram application for Android until a fixed version is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-05863

CVE-2024-7014

Affected Products

Telegram For Android

References · 31

• 🔥 https://github.com/absholi7ly/PoC-for-CVE-2024-7014-Exploit · Exploit
• https://osv.dev/vulnerability/CVE-2024-7014 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05863 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-7014 · Security Note
• https://twitter.com/devwizardoh/status/1876833337211236598 · Twitter Post
• https://twitter.com/LukasStefanko/status/1835992491100676527 · Twitter Post
• https://t.me/true_secator/6819 · Telegram Post
• https://twitter.com/UndercodeUpdate/status/1890534634775036342 · Twitter Post
• https://twitter.com/transilienceai/status/1906140505815036137 · Twitter Post
• https://twitter.com/CyberDhaal/status/1897247593346019751 · Twitter Post
• https://github.com/advisories/GHSA-6hr2-22jp-cfqq · Note
• https://vuldb.com/ru/?id.272279 · Note
• https://twitter.com/lon3_rang3r/status/1897503162472522217 · Twitter Post
• https://t.me/cvedetector/1500 · Telegram Post
• https://twitter.com/transilienceai/status/1901243480820908539 · Twitter Post