Critical WhatsApp Vulnerabilities Found

BugBase - The BugGyaan Blog
3 min readSep 28, 2022

--

WhatsApp has recently fixed a critical and high-severity vulnerability affecting WhatsApp for Android, WhatsApp Business for Android, WhatsApp for iOS, and WhatsApp Business for iOS. The Indian Computer Emergency Response Team (CERT-In) has also issued high-severity security warning for WhatsApp users in India.

A recent RCE flaw has been identified as CVE-2022–36934 in WhatsApp, and it targets several Android and iOS users. An established video conversation may be subjected to remote code execution upon exploiting this vulnerability due to a security issue in the WhatsApp program.

This vulnerability was, however, disclosed on September 22, 2022, and fixed and updated on September 24, 2022.

Nevertheless, what exactly is an RCE(Remote Code Execution)?

Remote code execution (RCE) attacks allow an attacker to execute malicious code on a computer remotely. The impact of an RCE vulnerability can range from malware execution to an attacker gaining complete control over a compromised machine.

RCE vulnerabilities allow an attacker to execute arbitrary code on a remote device. An attacker can achieve RCE in a few different ways, including:

· Injection Attacks

· Deserialization Attacks

· Out-of-Bounds Write

A vulnerability detected in an application such as Whatsapp is a matter of concern. It has been noted to be a form of an Integer Overflow attack.

This attack is executed in the following manner; a program performs a calculation, and if the true answer is larger than the available space, it may result in an integer overflow. These integer overflows can cause the program to use incorrect numbers and respond unintendedly, which attackers can exploit. This attack has a negative impact on the confidentiality, integrity, and availability of the asset.

WHAT NOW?

WhatsApp released a patch to fix the RCE critical vulnerability (CVE-2021–24026). This vulnerability has a CVSSv3 base score of 9.8 and should be prioritized for patching. It affects assets running:

· WhatsApp for Android prior to v2.21.3

· WhatsApp Business for Android prior to v2.21.3

· WhatsApp for iOS prior to v2.21.32

· WhatsApp Business for iOS prior to v2.21.32

Users are advised to update to the newer versions of the app and prevent installing any cracked versions, or APK versions.

What is BugBase?

BugBase is a curated marketplace for ethical hackers that helps businesses and startups set up bug bounty programs. It is India’s first consolidated bug bounty platform, which assists organizations in staying safe by providing an all-in-one platform for continuous and comprehensive security testing.

Through BugBase registering and setting up your organisation’s bug bounty program is no less than a breeze. We also provide hackers and security professionals with the platform to directly get connected with organizations that have set up their bug bounty programs and get rewarded for the risks and vulnerabilities they find.

Thank you for being part of our BugFam! Stay up to date on our latest posts and hope you had a great week!

Join our discord community for regular updates and much more fun!!

Cheers,

BugBase Team

--

--

BugBase - The BugGyaan Blog

India’s first consolidated Bug Bounty Platform’s technical blog by Aditya Arun Iyer