VYPR
← All advisories
Medium severity5.9NVD Advisory· Published Feb 9, 2017· Updated May 13, 2026

CVE-2017-5858

CVE-2017-5858

Description

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Converse.js (0.8.0 - 1.0.6, 2.0.0 - 2.0.4).

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
converse.jsnpm
< 1.0.71.0.7
converse.jsnpm
>= 2.0.0, < 2.0.52.0.5

Affected products

28
  • Conversejs/Converse.js28 versions
    cpe:2.3:a:conversejs:converse.js:0.10.0:*:*:*:*:*:*:*+ 27 more
    • cpe:2.3:a:conversejs:converse.js:0.10.0:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:0.10.1:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:0.8.0:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:0.8.1:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:0.8.2:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:0.8.3:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:0.8.4:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:0.8.5:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:0.8.6:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:0.9.0:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:0.9.1:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:0.9.2:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:0.9.3:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:0.9.4:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:0.9.5:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:0.9.6:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:1.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:1.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:1.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:1.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:1.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:1.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:1.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:2.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:2.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:2.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:2.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:conversejs:converse.js:2.0.4:*:*:*:*:*:*:*

Patches

1
42f249cabbbf

Prevent forging of messages via carbons.

https://github.com/jcbrand/converse.jsJC BrandJan 31, 2017via ghsa
commit
3 files changed · +53 −2
  • docs/CHANGES.md+1 −0 modified
    @@ -10,6 +10,7 @@
 - Bugfix. Login form wasn't rendered after logging out (when `auto_reconnect` is `true`). [jcbrand]
 - Bugfix. Properly disconnect upon "host-unknown" error. [jcbrand]
 - Bugfix. Minimized chats weren't removed when logging out. [jcbrand]
+- Security fix: Prevent message forging via carbons. (Thanks to ge0rg) [jcbrand]
 
 ## 2.0.4 (2016-12-13)
 - #737: Bugfix. Translations weren't being applied. [jcbrand]
  • spec/chatbox.js+44 −1 modified
    @@ -766,7 +766,7 @@
                     var msgtext = 'This is a carbon message';
                     var sender_jid = mock.cur_names[1].replace(/ /g,'.').toLowerCase() + '@localhost';
                     var msg = $msg({
-                            'from': converse.bare_jid,
+                            'from': sender_jid,
                             'id': (new Date()).getTime(),
                             'to': converse.connection.jid,
                             'type': 'chat',
@@ -844,6 +844,49 @@
                     expect(msg_txt).toEqual(msgtext);
                 }));
 
+                it("will be discarded if it's a malicious message meant to look like a carbon copy", mock.initConverse(function (converse) {
+                    test_utils.createContacts(converse, 'current');
+                    test_utils.openControlBox();
+                    test_utils.openContactsPanel(converse);
+                    /* <message from="mallory@evil.example" to="b@xmpp.example">
+                     *    <received xmlns='urn:xmpp:carbons:2'>
+                     *      <forwarded xmlns='urn:xmpp:forward:0'>
+                     *          <message from="alice@xmpp.example" to="bob@xmpp.example/client1">
+                     *              <body>Please come to Creepy Valley tonight, alone!</body>
+                     *          </message>
+                     *      </forwarded>
+                     *    </received>
+                     * </message>
+                     */
+                    spyOn(converse, 'log');
+                    var msgtext = 'Please come to Creepy Valley tonight, alone!';
+                    var sender_jid = mock.cur_names[1].replace(/ /g,'.').toLowerCase() + '@localhost';
+                    var impersonated_jid = mock.cur_names[2].replace(/ /g,'.').toLowerCase() + '@localhost';
+                    var msg = $msg({
+                            'from': sender_jid,
+                            'id': (new Date()).getTime(),
+                            'to': converse.connection.jid,
+                            'type': 'chat',
+                            'xmlns': 'jabber:client'
+                        }).c('received', {'xmlns': 'urn:xmpp:carbons:2'})
+                          .c('forwarded', {'xmlns': 'urn:xmpp:forward:0'})
+                          .c('message', {
+                                'xmlns': 'jabber:client',
+                                'from': impersonated_jid,
+                                'to': converse.connection.jid,
+                                'type': 'chat'
+                        }).c('body').t(msgtext).tree();
+                    converse.chatboxes.onMessage(msg);
+
+                    // Check that chatbox for impersonated user is not created.
+                    var chatbox = converse.chatboxes.get(impersonated_jid);
+                    expect(chatbox).not.toBeDefined();
+
+                    // Check that the chatbox for the malicous user is not created
+                    chatbox = converse.chatboxes.get(sender_jid);
+                    expect(chatbox).not.toBeDefined();
+                }));
+
                 it("received for a minimized chat box will increment a counter on its header", mock.initConverse(function (converse) {
                     test_utils.createContacts(converse, 'current');
                     test_utils.openControlBox();
  • src/converse-core.js+8 −1 modified
    @@ -1447,7 +1447,14 @@
                 }
                 $forwarded = $message.find('forwarded');
                 if ($forwarded.length) {
-                    $message = $forwarded.children('message');
+                    var $forwarded_message = $forwarded.children('message');
+                    if (Strophe.getBareJidFromJid($forwarded_message.attr('from')) !== from_jid) {
+                        // Prevent message forging via carbons
+                        //
+                        // https://xmpp.org/extensions/xep-0280.html#security
+                        return true;
+                    }
+                    $message = $forwarded_message;
                     $delay = $forwarded.children('delay');
                     from_jid = $message.attr('from');
                     to_jid = $message.attr('to');

Vulnerability mechanics

Synthesis attempt was rejected by the grounding validator. Re-run pending.

References

11

News mentions

0

No linked articles in our index yet.