WhatsApp Exploit POC Allows Attackers to Hijack Chat Sessions Via Malicious GIFs

  •  
  •  
  •  
  • 2
  •  
  •  
  •  
    2
    Shares

Heads up WhatsApp users! If you haven’t updated your WhatsApp yet, you must do it now as a serious security flaw exposes your chats to attackers. A security researcher has discovered an RCE vulnerability in WhatsApp that allows hijacking chat sessions simply by sending malicious GIFs.

WhatsApp RCE Vulnerability Discovered

According to the report shared by a researcher with the alias ‘Awakened’, a serious bug threatens the privacy of WhatsApp users. As discovered,  a double-free RCE vulnerability exists in WhatsApp Messenger exploiting which allows for hijacking chat sessions.

To exploit the flaw, an attacker would simply need to send a malicious GIF to the victim. An adversary could trigger the flaw in two ways.

First, via local privilege escalation through a malicious app installed on the target device. According to the researcher,

The app collects addresses of zygote libraries and generates a malicious GIF file that results in code execution in WhatsApp context.

This would allow stealing files in WhatsApp sandbox.

Second, via remote code execution by sending a malicious GIF. As explained by the researcher,

Pairing with an application that has a remote memory information disclosure vulnerability (e.g. browser), the attacker can collect the addresses of zygote libraries and craft a malicious GIF file to send it to the user via WhatsApp (must be as an attachment, not as an image through Gallery Picker).

When the recipient opens the Gallery view in WhatsApp, the GIF would trigger the remote shell on the target device:

Awakened has demonstrated the exploit in the following video. (Click here to view the demo in case of any error) . Whereas, the detailed technical write-up is available here.

The proof of concept exploit code can be found here

Update WhatsApp Now!

The vulnerability CVE-2019-11932 discovered by Awakened allegedly affected WhatsApp versions until 2.19.230. It primarily posed a threat to Android 8.1 and 9.0. this is because for Android versions before 8.1, triggering the exploit crashes the app before the hack.

In the older Android versions, double-free could still be triggered. However, because of the malloc calls by the system after the double-free, the app just crashes before reaching to the point that we could control the PC register.

After discovering the bug, the researcher reported the matter to Facebook for further action. Following his report, Facebook patched the flaw with WhatsApp version 2.19.244.

The following two tabs change content below.
Avatar

Abeerah Hashim

Abeerah has been a passionate blogger for several years with a particular interest towards science and technology. She is crazy to know everything about the latest tech developments. Knowing and writing about cybersecurity, hacking, and spying has always enchanted her. When she is not writing, what else can be a better pastime than web surfing and staying updated about the tech world! Reach out to me at: [email protected]
Avatar

Abeerah Hashim

Abeerah has been a passionate blogger for several years with a particular interest towards science and technology. She is crazy to know everything about the latest tech developments. Knowing and writing about cybersecurity, hacking, and spying has always enchanted her. When she is not writing, what else can be a better pastime than web surfing and staying updated about the tech world! Reach out to me at: [email protected]

Do NOT follow this link or you will be banned from the site!