Cryptocat up to 2.0.21 cryptocat.js handlePresence cross site scripting

Summaryinfo

A vulnerability was found in Cryptocat up to 2.0.21. It has been declared as critical. This issue affects the function handlePresence of the file cryptocat.js. Executing a manipulation can lead to cross site scripting. This vulnerability is tracked as CVE-2013-4107. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Cryptocat up to 2.0.21. This vulnerability affects the function handlePresence of the file cryptocat.js. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was disclosed 11/07/2012 by Mario Heiderich, Krzysztof Koktowicz and Maxim Rupp with Cure53 as confirmed bulletin (Website). The advisory is available at blog.crypto.cat. The public release has been coordinated in cooperation with the vendor. This vulnerability was named CVE-2013-4107 since 06/12/2013. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1059.007 by the MITRE ATT&CK project.

After immediately, there has been an exploit disclosed.

Upgrading to version 2.0.22 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at OSVDB (95005†). Additional details are provided at blog.crypto.cat. The entries VDB-9432, VDB-9433, VDB-9434 and VDB-9435 are pretty similar. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Cryptocat

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.0.9
• 2.0.10
• 2.0.11
• 2.0.12
• 2.0.13
• 2.0.14
• 2.0.15
• 2.0.16
• 2.0.17
• 2.0.18
• 2.0.19
• 2.0.20
• 2.0.21

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion