Industry News

Signal App Delivers Timely Patch for Code Injection Vulnerability that Allows Remote Code Execution

A recent vulnerability in the Signal messaging application that enables encrypted communication between parties, could have enabled attackers to arbitrarily remotely execute code on the victim’s device without any user interaction.

Security researchers Iván Ariel Barrera Oro, Alfredo Ortega and Juliano Rizzo accidentally triggered the vulnerability while exchanging URLs that contained various XSS (cross-site scripting) payloads. Combined with iframes, attackers could leverage the vulnerability to execute arbitrary code on the victim’s device.

“We tried different kinds of HTML elements: img, form, script, object, frame, framset, iframe, sound, video (this last two where funny). They all worked, except that CSP blocked the execution of scripts, which halted in some way this attack,” wrote Iván Ariel Barrera Oro on his blog. “Inside iframes, everything was possible, even loading code from an SMB share! This enables an attacker to execute remote code without caring about CSP.”

Hours after the vulnerability was disclosed to the Signal team on May 15, a patch was released. Interestingly, researchers noted that the regex function used to validate URLs existed in previous versions of the Signal desktop app, but might have been accidentally removed in an April 10 build.

“However, the patch caught my attention: it was a big regex and I was surprised how fast they wrote it. So I decided to check on the file’s history to observe since when it has been vulnerable and I found this wonderful mistake: the applied “patch” already existed, but was (accidentally?) removed in a commit on April 10th to fix an issue with linking (I guess the issue is back  ). I’m still not convinced about that regex and I’m afraid someone might exploit it, especially those resourceful three-letter agencies…”

Everyone is strongly encouraged to use the latest Signal build to make sure threat actors cant’s exploit the vulnerability.

About the author

Liviu ARSENE

Liviu Arsene is the proud owner of the secret to the fountain of never-ending energy. That's what's been helping him work his everything off as a passionate tech news editor for the past couple of years. He is the youngest and most restless member of the Bitdefender writer team and he covers mobile malware and security topics with fervor and a twist. His passions revolve around gadgets and technology, and he's always ready to write about what's hot and trendy out there in geek universe.

Add Comment

Click here to post a comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.