| 제목 | jeremyckahn Chitchatter develop branch @ 23b62a8 (source) authentication bypass / identity takeover |
|---|
| 설명 | isConfigMessageEvent derives the trusted parent origin from the attacker-controllable parentDomain URL parameter; a malicious embedder can deliver a config postMessage with attacker-generated ECDSA key material that are merged into UserSettings and persisted in IndexedDB, enabling impersonation in E2E rooms. Static source review verified the full chain. |
|---|
| 원천 | ⚠️ https://github.com/0xGenesi/CVE/blob/main/Chitchatter_SDK_postMessage_Identity_Key_Injection.md |
|---|
| 사용자 | chenhuanlin (UID 100424) |
|---|
| 제출 | 2026. 10. 06. AM 06:44 (22 날 ago) |
|---|
| 모더레이션 | 2026. 10. 27. PM 05:49 (22 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 427456 [jeremyckahn Chitchatter 까지 f82538633813c854a81a8b2112a2f6ba17b39cbc PostMessage src/Bootstrap.tsx isConfigMessageEvent parentDomain 약한 인증] |
|---|
| 포인트들 | 18 |
|---|