In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that would launch the Clash Windows client and force it to open a remote SMB share. Windows will perform NTLM authentication when opening the SMB share and that request can be relayed (using a tool like responder) for code execution (or captured for hash cracking).
References
| Link | Resource |
|---|---|
| https://github.com/Dreamacro/clash/issues/910 | Exploit Issue Tracking Third Party Advisory |
| https://github.com/Dreamacro/clash/issues/910 | Exploit Issue Tracking Third Party Advisory |
Configurations
History
21 Nov 2024, 05:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/Dreamacro/clash/issues/910 - Exploit, Issue Tracking, Third Party Advisory |
29 Mar 2022, 13:57
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://github.com/Dreamacro/clash/issues/910 - Exploit, Issue Tracking, Third Party Advisory | |
| CPE | cpe:2.3:a:clash_project:clash:0.11.4:*:*:*:*:windows:*:* | |
| CWE | CWE-346 | |
| CVSS |
v2 : v3 : |
v2 : 6.8
v3 : 8.8 |
23 Mar 2022, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that would launch the Clash Windows client and force it to open a remote SMB share. Windows will perform NTLM authentication when opening the SMB share and that request can be relayed (using a tool like responder) for code execution (or captured for hash cracking). |
21 Mar 2022, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-03-21 15:15
Updated : 2024-11-21 05:16
NVD link : CVE-2020-24772
Mitre link : CVE-2020-24772
CVE.ORG link : CVE-2020-24772
JSON object : View
Products Affected
clash_project
- clash
CWE
CWE-346
Origin Validation Error