CVE-2018-11101 is a cross-site scripting (XSS) vulnerability in Open Whisper Signal (Signal-Desktop) through version 1.10.1. An attacker can inject malicious HTML, specifically SCRIPT, IFRAME, or IMG elements, into a chat message. This vulnerability is triggered when a user replies to the specially crafted message, leading to JavaScript execution within the Signal-Desktop client. The vulnerability has a CVSS score of 6.1 (Medium), indicating a network-based attack with low attack complexity, requiring user interaction, and resulting in low impact to confidentiality and integrity. On Windows, it can enable full code execution by referencing scripts on SMB shares within an IFRAME. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. However, there has been some community discussion, including a Reddit post detailing the accidental discovery of the RCE potential.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.10.1CPE matchmatch criteria | cpe:2.3:a:signal:signal-desktop:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.