CVE-2017-5858 User Impersonation in converse.js
Remote attackers can impersonate users in Converse.js chat displays due to incorrect Message Carbons implementation, enabling social engineering.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-5858?
CVE-2017-5858 is a medium-severity vulnerability in n/a, published on 9 Feb 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Converse.js (0.8.0 - 1.0.6, 2.0.0 - 2.0.4).
Which versions are affected by CVE-2017-5858?
4 open source packages ship an affected version, including converse.js. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
converse.js npm | All versions | 1.0.7 |
converse.js npm | All versions | 1.0.7 |
converse.js npm | From 2.0.0 | 2.0.5 |
converse.js npm | From 2.0.0 | 2.0.5 |
Products include Conversejs Converse.js.
How do I fix CVE-2017-5858?
Upgrade converse.js to a fixed version for your release line: 1.0.7 or 2.0.5.
Is CVE-2017-5858 being exploited?
There is no known exploitation of CVE-2017-5858 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-w973-2qcc-p78x.