Executive brief
HexChat is a popular open-source chat application used to connect to IRC networks. A security flaw in version 2.11.0 allows a malicious chat server to bypass folder restrictions and read or modify files on a user's computer. This could lead to the theft of private chat logs or the installation of malicious plugins that run when the application starts.
Technical details
A directory traversal vulnerability exists in the 'log_create_pathname' function within 'src/common/text.c' of HexChat 2.11.0. While channel and network names are sanitized, the 'servname' (server name) provided by a remote IRC server is not properly validated before being used in file path construction via 'log_insert_vars'. An attacker controlling a malicious IRC server can use dot-dot (..) sequences in the server name to escape the intended log directory. This allows the creation or modification of files with the user's permissions, potentially targeting configuration files, auto-loading addons, or scrollback buffers. This exploit requires logging to be enabled and a non-default log path pattern (e.g., using '%s') to be configured.
Affected products
- HexChat Project HexChat 2.11.0
Timeline
- 2016-01-26: other: Vulnerability discovered by researcher
- 2016-04-04: disclosed: Exploit code published on Exploit-DB
- 2017-01-18: advisory: NVD advisory published