Vulnerability Description
In Wire before 3.20.x, `shell.openExternal` was used without checking the URL. This vulnerability allows an attacker to execute code on the victims machine by sending messages containing links with arbitrary protocols. The victim has to interact with the link and sees the URL that is opened. The issue was patched by implementing a helper function which checks if the URL's protocol is common. If it is common, the URL will be opened externally. If not, the URL will not be opened and a warning appears for the user informing them that a probably insecure URL was blocked from being executed. The issue is patched in Wire 3.20.x. More technical details about exploitation are available in the linked advisory.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wire | Wire | < 3.20.2934 |
Related Weaknesses (CWE)
References
- https://benjamin-altpeter.de/shell-openexternal-dangers/ExploitThird Party Advisory
- https://github.com/wireapp/wire-desktop/commit/b3705fffa75a03f055530f55a754face5PatchThird Party Advisory
- https://github.com/wireapp/wire-desktop/security/advisories/GHSA-5gpx-9976-ggpmExploitThird Party Advisory
- https://benjamin-altpeter.de/shell-openexternal-dangers/ExploitThird Party Advisory
- https://github.com/wireapp/wire-desktop/commit/b3705fffa75a03f055530f55a754face5PatchThird Party Advisory
- https://github.com/wireapp/wire-desktop/security/advisories/GHSA-5gpx-9976-ggpmExploitThird Party Advisory
FAQ
What is CVE-2020-15258?
CVE-2020-15258 is a vulnerability with a CVSS score of 8.0 (HIGH). In Wire before 3.20.x, `shell.openExternal` was used without checking the URL. This vulnerability allows an attacker to execute code on the victims machine by sending messages containing links with ar...
How severe is CVE-2020-15258?
CVE-2020-15258 has been rated HIGH with a CVSS base score of 8.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-15258?
Check the references section above for vendor advisories and patch information. Affected products include: Wire Wire.