CVE-2022-43673

secuvera-SA-2022-01: Windows Wire message reading after deletion Affected Products Windows version of Wire Version 3.22.3993 (older releases have not been tested) References https://www.secuvera.de/advisories/secuvera-SA-2022-01.txt CVE-2022-43673 Summary: Wire is described by the manufacturer as the most secure collaboration platform, which keeps the user information private. The Wire chat messenger offers a user the possibility to delete sent messages or send self-deleting messages. By using this features a user is able to delete messages in the wire chat or send a message which deletes itself after an amount of time. Chat participants are not able to the read the deleted chat message afterwards. (see https://support.wire.com/hc/en-us/articles/210744649-Delete-a-message, https://support.wire.com/hc/en-us/articles/213216845-Send-a-self-deleting-message and https://wireapp.medium.com/safe-and-tidy-with-timed-messages%EF%B8%8F-4f26ff17b11b#.xco9e7rg5) Further Wire creates a log file in “AppData\Roaming\Wire\IndexedDB\https_app.wire.com_0.indexeddb.leveldb", in which messages are stored. Effect: Wire chat messages are stored in the log file in appdata. After the deletion in chat, stored messages are still readable for a limited period of time, because they are not deleted in the logfile until they are transferred to the database. Examples: By using the following powershell script, wire chat messages are displayed, even if they are deleted, but not transferred to the database. $logpath = $env:APPDATA + ‘\Wire\IndexedDB\https_app.wire.com_0.indexeddb.leveldb’ $logfile = Get-ChildItem $logpath | where name -like “*.log” | Select -ExpandProperty name $file = “$logpath\$logfile” Write-Output “Looking for messages in $file” $messages = Get-Content -Raw $file $pattern=’status_”(.*)mentionsA’ [regex]::Matches($messages, $pattern).Value Disclosure Timeline: 2022/05/11 vendor initially contacted with all details 2022/05/17 contacted vendor again and received an answer that the vendor was investigating how to improve this situation 2022/07/11 contacted vendor again after no answer was received 2022/07/12 vendor replied that there will be no change in the method of storing messages in Wire 2022/10/17 requested CVE identifier 2022/11/17 vendor is notified that the advisory will be published 2022/11/17 public disclosure