Wire
CVE-2021-41101
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (github) · only source for this CVE.
CVSS VectorVendor: github
Lifecycle Timeline
1DescriptionCVE.org
wire-server is an open-source back end for Wire, a secure collaboration platform. Before version 2.106.0, the CORS Access-Control-Allow-Origin header set by nginz is set for all subdomains of .wire.com (including wire.com). This means that if somebody were to find an XSS vector in any of the subdomains, they could use it to talk to the Wire API using the user's Cookie. A patch does not exist, but a workaround does. To make sure that a compromise of one subdomain does not yield access to the cookie of another, one may limit the Access-Control-Allow-Origin header to apps that actually require the cookie (account-pages, team-settings and the webapp).
AnalysisAI
wire-server is an open-source back end for Wire, a secure collaboration platform. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. wire-server is an open-source back end for Wire, a secure collaboration platform. Before version 2.106.0, the CORS Access-Control-Allow-Origin header set by nginz is set for all subdomains of .wire.com (including wire.com). This means that if somebody were to find an XSS vector in any of the subdomains, they could use it to talk to the Wire API using the user's Cookie. A patch does not exist, but a workaround does. To make sure that a compromise of one subdomain does not yield access to the cookie of another, one may limit the Access-Control-Allow-Origin header to apps that actually require the cookie (account-pages, team-settings and the webapp). Affected products include: Wire Wire Server. Version information: version 2.106.0.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
Wire before 2020-10-16 allows remote attackers to cause a denial of service (application crash) or possibly execute arbi
Restund is an open source NAT traversal server. Rated critical severity (CVSS 9.6), this vulnerability is remotely explo
Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a deserializer
In Wire before 3.20.x, `shell.openExternal` was used without checking the URL. Rated high severity (CVSS 8.0), this vuln
The Wire application before 2018-03-07 for Android allows attackers to write to pathnames outside of the downloads direc
wire-webapp is the web version of Wire, an open-source messenger. Rated medium severity (CVSS 6.1), this vulnerability i
Wire-server is the backing server for the open source wire secure messaging application. Rated critical severity (CVSS 9
Wire is an open source secure messenger. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire. Rated high s
Wire through 3.22.3993 on Windows advertises deletion of sent messages; nonetheless, all messages can be retrieved (for
Wire is an encrypted communication and collaboration platform. Rated high severity (CVSS 8.1), this vulnerability is rem
wire-server provides back end services for Wire, an open source messenger. Rated high severity (CVSS 8.1), this vulnerab
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today