Executive brief
D.Launcher 2 is a component of the Slovak eID (electronic ID) ecosystem used by citizens to interact with government services. A security flaw in how the application handles web links could allow an attacker to trick a user's computer into revealing sensitive login credentials (NTLM hashes) or making unauthorized internal network requests. To exploit this, an attacker would need to convince a user to click on a specially crafted link, potentially leading to unauthorized access to the user's account or internal corporate resources.
Technical details
D.Launcher 2 registers multiple custom URL handlers (such as ditec-dlauncher2://) that do not properly validate or neutralize input. An attacker can exploit this by crafting a malicious URL that, when opened by a victim, forces the application to initiate an SMB connection or NTLM authentication request to an attacker-controlled server, leaking the user's NTLM hash. Additionally, the flaw can be used to conduct Server Side Request Forgery (SSRF) attacks. The vulnerability is present in versions prior to 2.0.7.0 on Windows, macOS, and Linux. The fix involved removing support for NTLM/SPNEGO protocols in the handler and disabling internet access for specific URI schemes.
Affected products
- Ditec D.Launcher 2 versions prior to 2.0.7.0
- Ditec D.Suite/eIDAS versions prior to 2.0.7
Timeline
- 2026-05-04: patched: D.Launcher 2 v2.0.7.0 released with security fixes.
- 2026-06-02: disclosed: CVE-2026-8993 published.