Cisco rushes to kill WebEx remote code execution hole

By on
Cisco rushes to kill WebEx remote code execution hole

"Magic URL" could run code on users' computers.

Cisco has updated the Google Chrome browser extension for its popular WebEX business web conferencing software after a researcher discovered it could be abused to run arbitrary code remotely on users' computers.

Google Project Zero security researcher Tavis Ormandy analysed the WebEx Chrome extension's behaviour with a meeting running in the browser, and found that it works on any link that contained the 
"cwcsf-nativemsg-iframe-43c85c0d-d633-af5e-c056-32dc7efc570b.html" pattern.

Ormandy was able to code a proof of concept exploit that made the WebEx Chrome extension pop up the Windows calc.exe application.

He noted that as the magic pattern can be embedded in HTML inline frames, "there is not necessarily any user-visible indication of what is happening, visiting any website would be enough".

Cisco responded quickly to Ormandy's bug report, and over the weekend released the fixed version 1.0.3 of the WebEx Chrome extension.

The fix limits the magic URL to * and * domains, which means a user must click OK for remote code execution to occur.

Ormandy noted that the fix "does mean any XSS [cross-site scripting] on would allow remote code execution", but said if Cisco feels that that is an acceptable risk, the patch is adequate.

Cisco's WebEx extension for Google has around 20 million active users, Ormandy noted.

Update 25/1/17: Despite describing Cisco's patch as acceptable, Ormandy today revealed there were further remote code execution bugs in WebEX that need to be fixed.

The details of the vulnerabilities were not disclosed by Ormandy, pending a fix by Cisco.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © . All rights reserved.
In Partnership With

Most Read Articles

Log In

Username / Email:
  |  Forgot your password?