A vulnerability has been discovered in the TeamViewer Client for Linux which allows Remote Code Execution via Chat.
A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat feature. Exploitation requires user interaction by clicking the malicious link.
Sending a chat message requires the attacker to either be included in the recipient’s list or the recipient to have explicitly enabled chat messages from users outside their list. By default, this setting is disabled.
The vulnerability has been fixed with version 15.81.5 and additional versions listed below. We recommend updating to the latest available version.
At the time of publication, we are not aware of any prior public disclosure of this issue or any indication of exploitation in the wild.
Base Score 8.8 (High)
CVSS3.1 Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
TeamViewer Full Client (Linux)
TeamViewer Host (Linux)
TeamViewer Full Client V14 (Linux)
TeamViewer Host V14 (Linux)
TeamViewer Full Client V13 (Linux)
TeamViewer Host V13 (Linux)
We thank HeaZzy (Mathys KHALFA) & skav (Antoine RIEUL) for the discovery and responsible disclosure via TeamViewer’s Bug Bounty program.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
