CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-33905

Medium Severity
SVRS
30/100
CVSSv3
NA/10
EPSS
0.00034/1

CVE-2024-33905 is a Cross-Site Scripting (XSS) vulnerability in Telegram WebK before version 2.0.0 (488). This flaw allows attackers to inject malicious scripts into the Telegram WebK application through a crafted Mini Web App, specifically leveraging the postMessage web_app_open_link event type. The low SVRS score of 30 suggests a lower immediate risk compared to critical vulnerabilities, but the "In The Wild" tag indicates it's actively being exploited. An attacker could potentially steal sensitive user data or perform unauthorized actions on behalf of a user. While the CVSS score is 0, indicating no base severity, the presence "In The Wild" status elevates concern, underscoring the importance of applying the latest security patches. Mitigation involves updating Telegram WebK to a version 2.0.0 (489) or later. This vulnerability highlights the risks associated with untrusted web applications and the need for robust input validation and security measures in web applications.

TAGS
In The Wild
VECTOR STRING
PUBLICATION DATE2024-04-29
LAST MODIFIED2024-07-03
Eye Icon
SOCRadar
AI Insight

Description

CVE-2024-33905 is a cross-site scripting (XSS) vulnerability in Telegram WebK before version 2.0.0 (488). An attacker could exploit this vulnerability by sending a crafted Mini Web App to a victim. When the victim opens the Mini Web App, the attacker could execute arbitrary JavaScript code in the victim's browser.

Key Insights

  • The SVRS for CVE-2024-33905 is 30, indicating a low level of severity.
  • This vulnerability is not currently being exploited in the wild.
  • CISA has not issued a warning about this vulnerability.

Mitigation Strategies

  • Update Telegram WebK to version 2.0.0 (488) or later.
  • Use a web browser that supports XSS protection.
  • Be cautious when opening links from unknown sources.

Additional Information

If you have any further questions about this incident, you can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information.

Indicators of Compromise

No IOCs found for this CVE

Exploits

No exploits found for this CVE

Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CREATE FREE ACCOUNT
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

CVE-2024-33905 | Telegram WebK up to 1.x web_app_open_link cross site scripting
vuldb.com2025-04-03
CVE-2024-33905 | Telegram WebK up to 1.x web_app_open_link cross site scripting | A vulnerability classified as problematic was found in Telegram WebK up to 1.x. This vulnerability affects the function web_app_open_link. The manipulation leads to cross site scripting. This vulnerability was named CVE-2024-33905. The attack can be initiated remotely. There is no exploit available
vuldb.com
rss
forum
news

Social Media

No tweets found for this CVE

Affected Software

No affected software found for this CVE

References

ReferenceLink
[email protected]https://github.com/morethanwords/tweb/commit/2153ea9878668769faac8dd5931b7e0b96a9f129/src/components/popups/webApp.ts
[email protected]https://medium.com/%40pedbap/telegram-web-app-xss-session-hijacking-1-click-95acccdc8d90
[email protected]https://www.openwall.com/lists/oss-security/2024/04/28/4
[email protected]http://www.openwall.com/lists/oss-security/2024/04/30/4
[email protected]https://github.com/morethanwords/tweb/commit/2153ea9878668769faac8dd5931b7e0b96a9f129/src/components/popups/webApp.ts
[email protected]https://medium.com/%40pedbap/telegram-web-app-xss-session-hijacking-1-click-95acccdc8d90
[email protected]https://www.openwall.com/lists/oss-security/2024/04/28/4
GITHUBhttps://medium.com/@pedbap/telegram-web-app-xss-session-hijacking-1-click-95acccdc8d90

CWE Details

CWE IDCWE NameDescription
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence