Chaterm
Monthly
Login cross-site request forgery in the Chaterm desktop client before 0.12.1 allows unauthicated remote attackers to inject a forged login state by triggering a crafted chaterm:// OAuth deep-link callback that the client neither signs nor validates against the original state parameter. A victim only needs to visit an attacker-controlled page while the chaterm:// handler is registered; the client then completes login as the attacker's account, and if default data sync is enabled, saved hosts, passwords, and private keys are uploaded into that attacker-controlled account. Exploitation is conditional rather than trivial - it requires victim interaction and a reachable callback/login state (AC:H, AT:P), and the confidentiality impact scales with how many secrets the victim has stored; there is no confirmed active exploitation and no public exploit code identified at time of analysis, and the vendor has released the fix in 0.12.1, which adds RSA-SHA256 signature verification of deep-link callbacks plus time-bound pending-state tracking.
Login cross-site request forgery in the Chaterm desktop client before 0.12.1 allows unauthicated remote attackers to inject a forged login state by triggering a crafted chaterm:// OAuth deep-link callback that the client neither signs nor validates against the original state parameter. A victim only needs to visit an attacker-controlled page while the chaterm:// handler is registered; the client then completes login as the attacker's account, and if default data sync is enabled, saved hosts, passwords, and private keys are uploaded into that attacker-controlled account. Exploitation is conditional rather than trivial - it requires victim interaction and a reachable callback/login state (AC:H, AT:P), and the confidentiality impact scales with how many secrets the victim has stored; there is no confirmed active exploitation and no public exploit code identified at time of analysis, and the vendor has released the fix in 0.12.1, which adds RSA-SHA256 signature verification of deep-link callbacks plus time-bound pending-state tracking.