Executive brief
converse.js is a JavaScript library that enables real-time messaging in web applications using the XMPP protocol. A flawed implementation of the XEP-0280 Message Carbons standard allows remote attackers to impersonate any user, including contacts, leading to social engineering attacks and fraudulent communications appearing to come from trusted parties.
Technical details
The vulnerability stems from an incorrect implementation of XEP-0280 (Message Carbons) in converse.js versions prior to 1.0.7 (1.x series) and 2.0.5 (2.x series). This affects CWE-20 (Improper Input Validation) and CWE-346 (Origin Validation Error), allowing a remote attacker over the network to forge messages without authentication. By exploiting the carbons feature's insufficient validation, an attacker can craft XMPP stanzas that deceive clients into displaying messages as originating from other users. The attack requires no user interaction or special privileges and is fixed by upgrading to the patched versions.
Affected products
- conversejs converse.js <1.0.7 (1.x); 2.0.0 to <2.0.5 (2.x)
Timeline
- 2017-02: disclosed: Vulnerability reported; public discussion on oss-security mailing list
- 2017: patched: Fixes committed to converse.js 1.0.7 and 2.0.5
- 2020-09-11: advisory: GHSA-w973-2qcc-p78x published