'No additional security measures had been put in place and it was therefore possible to both gain remote code execution and steal NTLM password hashes using this new injection point,' the researchers said. Worse, this vulnerability doesn't require user interaction and is wormable, meaning it can be used to automatically spread the malware to other systems by disguising the payload in a chat message.Ī second flaw, CVE-2020-27132, stems from the way it parses HTML tags in XMPP messages, an XML-based communications protocol used for facilitating instant messaging between any two or more network entities.ĭue to the lack of proper sanitization of these tags, a harmless file transfer message can be manipulated by injecting, say, an image HTML tag pointing to a malicious URL or even execute malicious JavaScript code. While the embedded browser is sandboxed to prevent unauthorized access to files, the researchers found a way to bypass the protections by abusing the window.CallCppFunction, which is designed to open files sent by other Cisco Jabber users.Īll an adversary has to do is initiate a file transfer containing a malicious '.exe' file and force the victim to accept it using an XSS attack, then trigger a call to the aforementioned function, causing the executable to be run on the victim's machine.

CEF or Chromium Embedded Framework is an open-source framework that's used to embed a Chromium-based web browser within other apps.

Cisco jabber for windows cost