CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-33905

Medium Severity
SVRS
30/100
CVSSv3
NA/10
EPSS
0.00034/1

CVE-2024-33905 is a Cross-Site Scripting (XSS) vulnerability in Telegram WebK before version 2.0.0 (488). This flaw allows attackers to inject malicious scripts into the Telegram WebK application through a crafted Mini Web App, specifically leveraging the postMessage web_app_open_link event type. The low SVRS score of 30 suggests a lower immediate risk compared to critical vulnerabilities, but the "In The Wild" tag indicates it's actively being exploited. An attacker could potentially steal sensitive user data or perform unauthorized actions on behalf of a user. While the CVSS score is 0, indicating no base severity, the presence "In The Wild" status elevates concern, underscoring the importance of applying the latest security patches. Mitigation involves updating Telegram WebK to a version 2.0.0 (489) or later. This vulnerability highlights the risks associated with untrusted web applications and the need for robust input validation and security measures in web applications.

TAGS
In The Wild
VECTOR STRING
PUBLICATION DATE2024-04-29
LAST MODIFIED2024-07-03
Eye Icon
SOCRadar
AI Insight

Description

CVE-2024-33905 is a cross-site scripting (XSS) vulnerability in Telegram WebK before version 2.0.0 (488). An attacker could exploit this vulnerability by sending a crafted Mini Web App to a victim. When the victim opens the Mini Web App, the attacker could execute arbitrary JavaScript code in the victim's browser.

Key Insights

  • The SVRS for CVE-2024-33905 is 30, indicating a low level of severity.
  • This vulnerability is not currently being exploited in the wild.
  • CISA has not issued a warning about this vulnerability.

Mitigation Strategies

  • Update Telegram WebK to version 2.0.0 (488) or later.
  • Use a web browser that supports XSS protection.
  • Be cautious when opening links from unknown sources.

Additional Information

If you have any further questions about this incident, you can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information.

Indicators of Compromise

No IOCs found for this CVE

Exploits

No exploits found for this CVE

Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CREATE FREE ACCOUNT
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

CVE-2024-33905 | Telegram WebK up to 1.x web_app_open_link cross site scripting
vuldb.com2025-04-03
CVE-2024-33905 | Telegram WebK up to 1.x web_app_open_link cross site scripting | A vulnerability classified as problematic was found in Telegram WebK up to 1.x. This vulnerability affects the function web_app_open_link. The manipulation leads to cross site scripting. This vulnerability was named CVE-2024-33905. The attack can be initiated remotely. There is no exploit available
vuldb.com
rss
forum
news
Re: Telegram Web app XSS / Session Hijacking 1-click
2024-04-30
Re: Telegram Web app XSS / Session Hijacking 1-click | Posted by Pedro Batista on Apr 30CVE-2024-33905
cve-2024-33905
cves
telegram
xss

Social Media

🚨 Newly patched XSS vulnerability in Telegram WebK allows session hijacking through malicious Mini Apps. Fixed in v2.0.0 (488) after quick response to report. https://t.co/VitIJeNM2d CVE-2024-33905 #vulmon #telegram #cybersecurity
0
0
0
🚨 A Cross-Site Scripting (XSS) flaw in #Telegram Web could lead to full account access, jeopardizing #data and #cryptowallets. 👉 Tracked as CVE-2024-33905, it affects versions prior to 2.0.0 (486), stemming from the #MiniApp system. 👉 Attackers exploit this via a malicious… https://t.co/quN4BKrE5R
1
0
3
⚠️ Telegram patched it on March 11, 2024, but users must update their web app for protection. Watch the Proof-of-Concept (#PoC) exploit for CVE-2024-33905: https://t.co/4hfOWpqo8u
1
0
0
CVE-2024-33905 In Telegram WebK before 2.0.0 (488), a crafted Mini Web App allows XSS via the postMessage web_app_open_link event type. https://t.co/NH6kXdI6mv
0
1
0

Affected Software

No affected software found for this CVE

References

ReferenceLink
[email protected]https://github.com/morethanwords/tweb/commit/2153ea9878668769faac8dd5931b7e0b96a9f129/src/components/popups/webApp.ts
[email protected]https://medium.com/%40pedbap/telegram-web-app-xss-session-hijacking-1-click-95acccdc8d90
[email protected]https://www.openwall.com/lists/oss-security/2024/04/28/4
[email protected]http://www.openwall.com/lists/oss-security/2024/04/30/4
[email protected]https://github.com/morethanwords/tweb/commit/2153ea9878668769faac8dd5931b7e0b96a9f129/src/components/popups/webApp.ts
[email protected]https://medium.com/%40pedbap/telegram-web-app-xss-session-hijacking-1-click-95acccdc8d90
[email protected]https://www.openwall.com/lists/oss-security/2024/04/28/4
GITHUBhttps://medium.com/@pedbap/telegram-web-app-xss-session-hijacking-1-click-95acccdc8d90

CWE Details

CWE IDCWE NameDescription
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence