CVE-2022-24799 Cross Site Scripting in Wire Webapp
Insufficient escaping in Wire webapp markdown allows attackers to inject JavaScript via malicious messages, leading to full account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-24799?
CVE-2022-24799 is a critical cross-site scripting vulnerability in wireapp wire-webapp, published on 20 Apr 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
wire-webapp is the web application interface for the wire messaging service. Insufficient escaping in markdown “code highlighting” in the wire-webapp resulted in the possibility of injecting and executing arbitrary HTML code and thus also JavaScript. If a user receives and views such a malicious message, arbitrary code is injected and executed in the context of the victim. This allows the attacker to fully control the user account. Wire-desktop clients that are connected to a vulnerable wire-webapp version are also vulnerable to this attack. The issue has been fixed in wire-webapp 2022-03-30-production.0 and is already deployed on all Wire managed services. On-premise instances of wire-webapp need to be updated to docker tag 2022-03-30-production.0-v0.29.2-0-d144552 or wire-server 2022-03-30 (chart/4.8.0), so that their applications are no longer affected. There are no known workarounds for this issue. ### Patches * The issue has been fixed in wire-webapp **2022-03-30-production.0** and is already deployed on all Wire managed services. * On-premise instances of wire-webapp need to be updated to docker tag **2022-03-30-production.0-v0.29.2-0-d144552** or wire-server **2022-03-30 (chart/4.8.0)**, so that their applications are no longer affected. ### Workarounds * No workarounds known ### For more information If you have any questions or comments about this advisory feel free to email us at [[email protected]](mailto:[email protected]) ### Credits We thank [Posix](https://twitter.com/po6ix) for reporting this vulnerability
Weakness: CWE-79
Which versions are affected by CVE-2022-24799?
It affects 1 product.
Products include Wire Wire-Webapp.
How do I fix CVE-2022-24799?
No fix has been published for CVE-2022-24799 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-24799 being exploited?
There is no known exploitation of CVE-2022-24799 in the wild and no public exploit code.
Other vulnerabilities in wireapp wire-webapp
- CVE-2022-29168 Cross Site Scripting in Wire Messages
- CVE-2021-32683 XSS through createObjectURL
- CVE-2021-21400 Entering code in App Lock modal sends input to conversation
- CVE-2025-48066 wire-webapp has no database deletion on client logout
- CVE-2022-39380 wire-webapp contains Improper Handling of Exceptional Conditions leading to a DoS via Markdown Rendering
Sources
Also known as GHSA-5568-rfh8-vmhq.