Vulnerability in WhatsApp Desktop Exposed User Files

guest · Feb 5, 2020

Vulnerability in WhatsApp Desktop Exposed User Files
February 5, 2020
https://www.securityweek.com/vulnerability-whatsapp-desktop-app-exposed-user-files

Tracked as CVE-2019-18426 and considered high severity (CVSS score 8.2), the security bug could be exploited by sending to the victim a specially crafted text message that included a link preview. Both Windows and macOS users were impacted.

The vulnerability was discovered by PerimeterX security researcher Gal Weizman, who said he found multiple issues in WhatsApp Desktop, starting with an open redirect into persistent XSS and Content Security Policy (CSP) bypass, and then a “cross platforms read from the local file system.”
Click to expand...

The WhatsApp Desktop applications for Windows and macOS are written using the Electron platform, which is Chromium-based, meaning that they should have been protected from the XSS attack.

However, because the apps were still based on a vulnerable version of Chrome — they used Chrome 69 when the latest stable version of Chrome was 78 — WhatsApp’s desktop users were exposed, the researcher explains.

“Since Chromium 69 is relatively old, exploiting a 1-day RCE is possible! There are more than 5 different 1-day RCEs in Chromium 69 or higher, you just need to find a published one and use it through the persistent XSS found earlier and BAM: Remote Code Execution achieved,” Weizman points out.
The researcher says he did not attempt any code execution attacks, but that he was able to use the fetch() API to read files from the local file system.
Click to expand...

PerimeterX: Critical Security Flaw Found in WhatsApp Desktop Platform Allowing Cybercriminals Read From The File System Access

Rasheed187 · Feb 8, 2020

So it's probably best to use Whatsapp Web.

https://thenextweb.com/basics/2019/08/02/how-to-use-whatsapp-on-your-pc/

Log in or Sign up

Vulnerability in WhatsApp Desktop Exposed User Files

guest Guest

Rasheed187 Registered Member

Log in or Sign up

Vulnerability in WhatsApp Desktop Exposed User Files

guest Guest

Rasheed187 Registered Member

Useful Searches