Telegram Desktop vulnerability allowed any user's file to be stolen

Telegram Desktop Vulnerability Allows Arbitrary File Read and Account Takeover

A critical vulnerability in Telegram Desktop allowed attackers to steal any file from a user's device through a crafted link. The flaw stemmed from improper handling of inter-process communication (IPC) and a lack of authorization checks in the interpret: URI scheme, enabling arbitrary file reads and potential account takeover.

The vulnerability was discovered in versions of Telegram Desktop up to 7.2.8, with the issue confirmed on Windows (6.9.3). The exploit leveraged a combination of two defects: first, the improper escaping of semicolons in IPC commands, and second, the absence of authorization checks in the interpret: URI scheme, which allowed file reads without user confirmation.

When a user clicked on a maliciously crafted link, the Telegram Desktop application would pass the link to its already-running instance via a local socket. The link was serialized into a text format, with each command separated by a semicolon. If a malicious link contained an embedded semicolon, it could inject additional commands, such as CMD:quit or OPEN:interpret:, which would be processed as separate instructions by the running instance.

The interpret: URI scheme was originally designed for internal use, such as publishing Telegram updates. However, it allowed the application to read any file from the disk and send it to a specified chat without requiring user confirmation. This functionality was not restricted to trusted sources, making it a potential vector for data exfiltration.

An attacker could exploit this by sending a malicious file as an attachment in a group chat. Telegram Desktop would automatically download the file to a predictable location on the user's device. By crafting a link that triggered the interpret: URI scheme with the path to the malicious file, an attacker could read and exfiltrate sensitive data, such as SSH private keys, browser password stores, or API tokens.

The vulnerability was addressed in version 7.2.9 with a commit that fixed the improper handling of semicolons in IPC commands and added authorization checks to the interpret: URI scheme. Users are advised to update to the latest version to mitigate the risk of exploitation.

This incident highlights the importance of secure IPC design and the need for strict authorization checks in internal URI schemes. Developers should ensure that all input is properly escaped and that privileged operations are restricted to trusted sources.

Source: Hacker News Best. Analysis based on publicly available information; no hands-on testing is claimed.