CVE-2020-15914

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the Origin Client for Mac and PC version 10.5.86 or earlier. The flaw resides in the chat message handling, allowing arbitrary JavaScript injection via a specially crafted text chat message. The vulnerable code path is triggered when the client starts and processes queued messages [1].

Exploitation

To exploit, an attacker must have a valid Origin account and be on the target user's friends list. The attacker sends a crafted message containing JavaScript via Origin's text chat. The payload does not execute immediately if the user is currently running Origin; instead, it will execute when the client next starts. If the user is not running Origin, the payload executes on the next launch. An alternative is to convince the user to restart Origin [1].

Impact

Successful exploitation allows arbitrary JavaScript execution in the Origin client. The attacker can access sensitive data related to the target's Origin account and control or monitor the Origin text chat window [1].

Mitigation

The vulnerability is fixed in an update to the Origin Client. EA has released a fix, though the specific fixed version is not disclosed in the advisory. Users should ensure their Origin Client is up to date to mitigate the risk [1].