CVE-2018-11101

{"id": "CVE-2018-11101", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2018-05-17T19:29:00.557", "references": [{"url": "http://seclists.org/fulldisclosure/2018/May/46", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Open Whisper Signal (aka Signal-Desktop) through 1.10.1 allows XSS via a resource location specified in an attribute of a SCRIPT, IFRAME, or IMG element, leading to JavaScript execution after a reply, a different vulnerability than CVE-2018-10994. The attacker needs to send HTML code directly as a message, and then reply to that message to trigger this vulnerability. The Signal-Desktop software fails to sanitize specific HTML elements that can be used to inject HTML code into remote chat windows when replying to an HTML message. Specifically the IMG and IFRAME elements can be used to include remote or local resources. For example, the use of an IFRAME element enables full code execution, allowing an attacker to download/upload files, information, etc. The SCRIPT element was also found to be injectable. On the Windows operating system, the CSP fails to prevent remote inclusion of resources via the SMB protocol. In this case, remote execution of JavaScript can be achieved by referencing the script on an SMB share within an IFRAME element, for example: <IFRAME src=\\\\DESKTOP-XXXXX\\Temp\\test.html> and then replying to it. The included JavaScript code is then executed automatically, without any interaction needed from the user. The vulnerability can be triggered in the Signal-Desktop client by sending a specially crafted message and then replying to it with any text or content in the reply (it doesn't matter)."}, {"lang": "es", "value": "Open Whisper Signal (tambi\u00e9n conocido como Signal-Desktop) hasta la versi\u00f3n 1.10.1 permite Cross-Site Scripting (XSS) mediante una localizaci\u00f3n de recurso especificada en un atributo de un elemento SCRIPT, IFRAME o IMG, lo que conduce a la ejecuci\u00f3n de JavaScript tras una respuesta. Esta vulnerabilidad es diferente de CVE-2018-10994. El atacante necesita enviar c\u00f3digo HTML directamente como mensaje y, despu\u00e9s, responder a ese mensaje para desencadenar esta vulnerabilidad. El software Signal-Desktop no sanea los elementos HTML especiales que se pueden utilizar para inyectar c\u00f3digo HTML en las ventanas de chat remoto al responder a un mensaje HTML. Espec\u00edficamente, los elementos IMG e IFRAME pueden emplearse para incluir recursos remotos o locales. Por ejemplo, el uso de un elemento IFRAME habilita la ejecuci\u00f3n de c\u00f3digo total, lo que permite que un atacante descargue/suba archivos, informaci\u00f3n, etc. Se ha descubierto que el elemento SCRIPT tambi\u00e9n es inyectable. En el sistema operativo de Windows, CSP no evita la inclusi\u00f3n de recursos mediante el protocolo SMB. En este caso, la ejecuci\u00f3n remota de JavaScript puede lograrse referenciando el script en una compartici\u00f3n SMB en un elemento IFRAME, por ejemplo: >IFRAME src=\\\\DESKTOP-XXXXX\\Temp\\test.html> y despu\u00e9s contestando. El c\u00f3digo JavaScript incluido se ejecuta de forma autom\u00e1tica, sin que se necesite interacci\u00f3n por parte del usuario. La vulnerabilidad puede desencadenarse en el cliente Signal-Desktop mediante el env\u00edo de un mensaje especialmente manipulado y, despu\u00e9s, contestando con cualquier texto o contenido en la respuesta (no importa)."}], "lastModified": "2018-06-19T18:24:15.630", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:signal:signal-desktop:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4595B8BE-95ED-4A15-BA6E-AC6D41D9FD85", "versionEndIncluding": "1.10.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}