Details and exploitation method of the vulnerability (CVE-2026-107181) in Telegram Desktop, the official Telegram client for desktop systems, have been revealed. The issue arises from inadequate handling of unescaped delimiter characters in IPC commands, allowing an attacker to transfer any files from the victim's system, including files with session keys, which can be used to hijack a Telegram account, by clicking on a sent link. The vulnerability has been fixed in Telegram Desktop version 7.2.9.
When clicking on 'tg://' links, the operating system launches the associated application, Telegram Desktop. If another instance of the application is already running on the system, the running process sends the link to it via a socket using the IPC interface. The problem is that if a ';' character is included among the link parameters (e.g., 'tg://x?a=1;OPEN...'), the content is split, and the parts following the ';' character are processed as separate commands.
To carry out the attack, the OPEN command is used together with the URI scheme 'interpret:', intended for executing scripts via IPC that were used to automatically send new releases to channels. The script consists of a predefined local file that specifies the file to be sent to the channel and the channel ID. The file path to the scripts is processed relative to the service subdirectory, but due to a lack of sanitization of '../' in file paths, the attacker can access files stored outside the base directory. For example, a file can be uploaded to their Telegram group, after which they can reference this file as a script by preparing a link like:
tg://x?a=1;OPEN:interpret:../../../Downloads/Telegram%20Desktop/instructions.txt
Steps to carry out the attack:
- The attacker adds the victim to their group (under default settings, adding does not require confirmation from the one being added) and sends a text file to this group, which specifies the channel and the path to the script. Telegram will save this file in a predefined system subdirectory when the victim enters the group.
channel: 2005234537
file: tdata/D877F783D5D3EF8Cs - The attacker sends the victim an innocently looking link to their host (e.g., 'https://coolsite.org'), which, when opened, is redirected to de server the attacker and is replaced with a URI of the type 'tg://x?a=1;OPEN:interpret:...;OPEN:interpret:...'
- Bij het klikken op de link roept de browser de URI-handler Ā«tg://Ā» aan, die de eerder genoemde reeks opstartcommando's activeert, wat leidt tot het verzenden van bestanden naar het kanaal van de aanvaller zonder enige melding en zonder om bevestiging om verzending te vragen.
- Nadat bestanden zijn ontvangen uit de subdirectory tdata met versleutelings- en autorisatiesleutels, kan de aanvaller, in het geval dat de gebruiker geen lokale wachtwoord heeft ingesteld, de connectiesessie van het slachtoffer op zijn apparaat klonen.
Bron: opennet.ru
