CVE-2022-29168 Cross Site Scripting in Wire Messages
Attackers can execute arbitrary JavaScript via malicious mentions in Wire messages, leading to full account takeover for victims.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-29168?
CVE-2022-29168 is a critical cross-site scripting vulnerability in wireapp wire-webapp, published on 25 Jun 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Wire is a secure messaging application. Wire is vulnerable to arbitrary HTML and Javascript execution via insufficient escaping when rendering `@mentions` in the wire-webapp. If a user receives and views a malicious message, arbitrary code is injected and executed in the context of the victim allowing the attacker to fully control the user account. Wire-desktop clients that are connected to a vulnerable wire-webapp version are also vulnerable to this attack. The issue has been fixed in wire-webapp 2022-05-04-production.0 and is already deployed on all Wire managed services. On-premise instances of wire-webapp need to be updated to docker tag 2022-05-04-production.0-v0.29.7-0-a6f2ded or wire-server 2022-05-04 (chart/4.11.0) or later. No known workarounds exist.
Which versions are affected by CVE-2022-29168?
It affects 1 product.
Products include Wire Wire-Webapp.
How do I fix CVE-2022-29168?
No fix has been published for CVE-2022-29168 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-29168 being exploited?
There is no known exploitation of CVE-2022-29168 in the wild and no public exploit code.
Other vulnerabilities in wireapp wire-webapp
- CVE-2022-24799 Cross Site Scripting in Wire Webapp
- CVE-2021-32683 XSS through createObjectURL
- CVE-2021-21400 Entering code in App Lock modal sends input to conversation
- CVE-2025-48066 wire-webapp has no database deletion on client logout
- CVE-2022-39380 wire-webapp contains Improper Handling of Exceptional Conditions leading to a DoS via Markdown Rendering
Sources
Also known as GHSA-jgv3-4j56-fvh6.