CVE-2022-34771 Tabit - arbitrary SMS send on Tabits behalf

Medium 5.5 Published 22 Aug 2022 Updated 16 Sep 2024

Attackers can send arbitrary SMS messages to any registered user via the resend OTP API, potentially enabling phishing or spam campaigns.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-34771?

CVE-2022-34771 is a medium-severity vulnerability in Tabit, published on 22 Aug 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Tabit - arbitrary SMS send on Tabits behalf. The resend OTP API of tabit allows an adversary to send messages on tabits behalf to anyone registered on the system - the API receives the parameters: phone number, and CustomMessage, We can use that API to craft malicious messages to any user of the system. In addition, the API probably has some kind of template injection potential. When entering {{OTP}} in the custom message field it is formatted into an OTP.

Which versions are affected by CVE-2022-34771?

It affects 1 product.

Products include Tabit Tabit.

How do I fix CVE-2022-34771?

No fix has been published for CVE-2022-34771 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-34771 being exploited?

There is no known exploitation of CVE-2022-34771 in the wild and no public exploit code.

Sources

Also known as GHSA-gxfw-27c3-xr84.