WhatsApp Messenger Runs Arbitrary Python Code

WATCH MORE:

🔥YOUTUBE ALGORITHM ➡ Like, Comment, & Subscribe!

[XerrolAvengerII]

what i learned: never check your email, never read a text message, install no apps, don't visit any websites, and you might be safe

[SaumyajeetDas]

Thank you, John, for sharing my work! It's incredibly rewarding to see the impact of my research on a global scale. Knowing that it helps make software more secure and protects users is a great feeling. Thanks again.

[iblackfeathers]

meta’s response makes one wonder how many times meta has said that the same bug has been reported by another user just to avoid paying them any bounty or giving them credit and without any way of the person reporting it to verify those claims.

[mvf]

This year must be a record-breaker for cybersecurity vulnerabilities.

[bowarc]

I don't understand why big companies like that do the simple mistake of using a deny list instead of an allow list, 'cause you'll allways forget an entry, so it's better to forget an allow than forget a deny.

I don't get it

[linuxares]

the .ps1 file running is even more scary than the python imho. Since Python require you to install python etc while Powershell is standard today.

[ShadowsDML]

As always companies don't want to pay the bounties so they say is not an issue but will then fix it afterwards. So basically what they are saying is: don't report issues to us, sell them instead on zerodium so at least you can get a "bounty".

[nathenbutcool]

Bad response from Meta. They are knowingly allowing an attack surface to exist on their platform when the fix could have been included in an update that has already been pushed.

[addas]

This wasn't allowed in previous versions, I remember I couldn't share APKs in WhatsApp, now I can!

[nathanchan]

It's called a 1-click ACE (arbitrary code execution) exploit. 0-click is even more vulnerable.. Nice demo John.

[GibusWearingMann]

Even if it's not a security concern, it's definitely a design concern. If clicking "open" on an exe doesn't execute the program, clicking "open" on a pyz or php shouldn't execute the program. The current behavior is inconsistent and confusing.

[njorogemuchirijr]

Come on John, everything is open source if you can reverse engineer! :D

[gerowen]

The .ps1 file opening in notepad is the new Windows 11 default. Now to execute a powershell script you either have to do so from within powershell already, or right click it and click "run with powershell".

[GauravMishra]

One way to think about this issue is that if Python introduces a new extension in the future, like pyxyz, how will WhatsApp handle it? This could make all previous versions vulnerable. Ideally, they should have implemented an allowlist, but if they couldn't for a valid reason, it becomes a cat-and-mouse game with researchers constantly searching for extensions that could execute code on the host system. And that could be why they didn't consider this a valid bug.

[AJ-ZR]

why was telegram's considered a 0day and this is not considered a vulnerability ?

[xtwmx]

Why even bother with a block list?
Just compile an allow list with most popular file types from sent history.
Nobody will complain if you forget to whitelist some rare file type.

[spammers]

If I send an email with calc.exe file as attachment; on Windows hosts, if you open it, it would open calculator. This doesn't mean Windows or Outlook has an ACE.

OR: Say we download a program/setup/game/app using Chrome. You open it from Chrome. It opens! We can't call that an ACE, afterall, just because it runs on Windows.

That's the whole point of a computer. It is designed to execute code.

Meta's RCE is in the context of WhatsApp means the potential vulnerability that they are referring to alters 𝗵𝗼𝘄 WhatsApp works.

If you send some code at their servers or through the app or send some media to a recipient and if it runs a piece of code on/within itself, then it's an issue.

You need to understand the difference between "running on WhatsApp" and "running outside WhatsApp". It's an ACE if its executed in the context of WhatsApp. Just because user asked it to open the file and the file opens, it cannot be called an ACE at all. It's what it is designed to do.

[TnY.]

In the data storage option, automatic download, always keep it disabled, but it is also very useful to remove with adb the facebook services and applications that run in the background, such as: meta app installer, meta app manager and meta services (android phone).
☠️

[ollydix]

You added transparency to your WhatsApp QR code which you can undo with various techniques. Security issue!

[ArthurKhazbs]

I suggest that apps with file sharing functionality switch to safelists when opening files. All filetypes that don't fall under the safelist should instead be located and highlighted in the file manager for the user to have a closer look first. Denylists should be kept too, because they are very useful for showing the warning in case the filetype is potentially dangerous, but they can't be solely relied on.