CVE-2023-24068
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to modify conversation attachments within the attachments.noindex directory. Client mechanisms fail to validate modifications of existing cached files, resulting in an attacker's ability to insert malicious code into pre-existing attachments or replace them completely. A threat actor can forward the existing attachment in the corresponding conversation to external groups, and the name and size of the file will not change, allowing the malware to masquerade as another file. NOTE: the vendor disputes the relevance of this finding because the product is not intended to protect against adversaries with this degree of local access.
Signal Desktop anterior a 6.2.0 en Windows, Linux y macOS permite a un atacante modificar archivos adjuntos de conversaciones dentro del directorio attachments.noindex. Los mecanismos del cliente no logran validar las modificaciones de los archivos almacenados en caché existentes, lo que da como resultado la capacidad del atacante de insertar código malicioso en archivos adjuntos preexistentes o reemplazarlos por completo. Un actor de amenazas puede reenviar el archivo adjunto existente en la conversación correspondiente a grupos externos, y el nombre y el tamaño del archivo no cambiarán, lo que permitirá que el malware se haga pasar por otro archivo. NOTA: el proveedor cuestiona la relevancia de este hallazgo porque el producto no está destinado a proteger contra adversarios con este grado de acceso local.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2023-01-23 CVE Reserved
- 2023-01-23 CVE Published
- 2024-08-22 CVE Updated
- 2024-08-22 First Exploit
- 2024-09-13 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
CAPEC
References (4)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://johnjhacking.com/blog/cve-2023-24068-cve-2023-24069 | 2024-08-22 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://signal.org/download/linux | 2024-05-17 | |
| https://signal.org/download/macos | 2024-05-17 | |
| https://signal.org/en/download/windows | 2024-05-17 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Signal Search vendor "Signal" | Signal-desktop Search vendor "Signal" for product "Signal-desktop" | <= 6.2.0 Search vendor "Signal" for product "Signal-desktop" and version " <= 6.2.0" | - |
Affected
| in | Apple Search vendor "Apple" | Macos Search vendor "Apple" for product "Macos" | - | - |
Safe
|
| Signal Search vendor "Signal" | Signal-desktop Search vendor "Signal" for product "Signal-desktop" | <= 6.2.0 Search vendor "Signal" for product "Signal-desktop" and version " <= 6.2.0" | - |
Affected
| in | Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | - | - |
Safe
|
| Signal Search vendor "Signal" | Signal-desktop Search vendor "Signal" for product "Signal-desktop" | <= 6.2.0 Search vendor "Signal" for product "Signal-desktop" and version " <= 6.2.0" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|