CVE-2024-2045 in Session
Summary
by MITRE • 03/01/2024
Session version 1.17.5 allows obtaining internal application files and public
files from the user's device without the user's consent. This is possible
because the application is vulnerable to Local File Read via chat attachments.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/19/2025
This vulnerability in Session version 1.17.5 represents a critical local file read flaw that enables unauthorized access to both internal application files and public user data without explicit user consent. The vulnerability stems from insufficient input validation and improper handling of file paths within the chat attachment functionality, creating an exploitable condition where malicious actors can traverse the file system and retrieve sensitive information. The flaw specifically affects how the application processes file attachments in chat conversations, allowing attackers to manipulate file paths and access files that should remain protected within the application's sandboxed environment. This vulnerability directly maps to CWE-22, known as "Improper Limitation of a Pathname to a Restricted Directory," which occurs when applications fail to properly restrict file access to authorized directories and files. The attack vector is particularly concerning as it leverages the legitimate chat attachment feature, making it difficult for users to detect unauthorized file access attempts. From an operational perspective, this vulnerability could result in significant data exposure including private messages, contact information, device storage contents, and potentially sensitive personal data stored within the application's file structure. The impact extends beyond simple information disclosure as it could enable further exploitation attempts such as credential theft, device reconnaissance, or privilege escalation within the application's context. The vulnerability aligns with ATT&CK technique T1074.001, "Data Staged: Local Data Staging," where adversaries stage data by accessing local files on compromised systems. Attackers could leverage this flaw to gather intelligence about the user's device configuration, application data structures, and potentially identify other security weaknesses within the application or operating system. The vulnerability is particularly dangerous because it operates silently in the background, allowing attackers to harvest data without triggering obvious user alerts or system warnings. Users may remain unaware of the unauthorized file access until significant damage has occurred, making this a stealthy and persistent threat vector. The implementation of proper input sanitization, strict file path validation, and comprehensive access controls within the chat attachment processing functionality would mitigate this vulnerability by preventing arbitrary file path traversal and ensuring that only authorized files can be accessed through the application's interface. Organizations should implement immediate patching procedures and consider monitoring for suspicious file access patterns as part of their incident response protocols when dealing with this type of vulnerability.