Headline
CVE-2023-28686: Insufficient message sender validation in Dino
Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive information.
Severity
Medium (5.3): AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected versions
- Release version 0.4.0 and 0.4.1
- Release version 0.3.0 and 0.3.1
- Release version 0.2.2 and earlier
- Nightly version 0.4.1-13-g6690d8e4 and earlier
Fixed versions
- Release version 0.4.2
- Release version 0.3.2
- Release version 0.2.3
- Nightly version 0.4.1-14-gef8fb0e9
Description
It was discovered that when a Dino client receives a specifically crafted message from an unauthorized sender, it would use information from that message to add, update or remove entries in the user’s personal bookmark store without requiring further user interaction.
This vulnerability allows the attacker to change how group chats are displayed or to force a user to join or leave an attacker-selected groupchat. This can be used to trick the user to reveal sensitive information to the attacker.
Advice
All deployments should upgrade to a fixed version or apply the patch from commit ef8fb0e94ce79d5fde2943e433ad0422eb7f70ec.
Credits
Many thanks to Kim Alvefur for discovering and reporting this issue.
Links
- https://dino.im/security/cve-2023-28686/
- https://github.com/dino/dino/commit/ef8fb0e94ce79d5fde2943e433ad0422eb7f70ec
- https://github.com/dino/dino/releases/tag/v0.4.2
- https://github.com/dino/dino/releases/tag/v0.3.2
- https://github.com/dino/dino/releases/tag/v0.2.3
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28686
- https://www.openwall.com/lists/oss-security/2023/03/23/1
- https://security-tracker.debian.org/tracker/CVE-2023-28686
- https://bugzilla.redhat.com/show_bug.cgi?id=2181356
Related news
Debian Linux Security Advisory 5379-1 - Kim Alvefur discovered that insufficient message sender validation in dino-im, a modern XMPP/Jabber client, may result in manipulation of entries in the personal bookmark store without user interaction via a specially crafted message. Additionally an attacker can take advantage of this flaw to change how group chats are displayed or force a user to join or leave an attacker-selected groupchat.