CVE-2020-3430

Upon installation, Cisco Jabber registers protocol handlers for a number of different protocols. These are used to tell the operating system that whenever a user clicks on a URL containing one of the custom protocols (e.g. ciscoim:[email protected]) the URL should be passed to Cisco Jabber. In this case, the protocol handlers specify that the URL should be passed as a command line flag.

These protocol handlers are vulnerable to command injection because they fail to consider URLs that contain spaces. By including a space in the URL, an attacker can inject arbitrary command line flags that will be passed to the application. Since the application uses CEF and accepts Chromium command line flags, several flags that can be used to execute arbitrary commands or load arbitrary DLLs exist. An example of such a flag is —GPU-launcher. This flag specifies a command that will be executed when CEFs GPU process is started.

This vulnerability can be combined with the XSS vulnerability to achieve code execution without transferring any files to the victim. This makes it possible to deliver malware without writing any files to disk, thus bypassing most antivirus software.

Recent assessments:

wvu-r7 at September 03, 2020 7:43pm UTC reported:

Please see CVE-2020-3495 for an example exploit chain.

Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 4