Telegram Desktop Vulnerability Allowed Remote File Theft via Malicious Links

Vulnerability Details

A security flaw in Telegram Desktop enabled attackers to steal files from users. The vulnerability stemmed from how the application processes clicked links when an instance is already running. Telegram Desktop communicates between instances using a local socket, sending link information as text.

The core issue involved improper escaping of the character used to separate commands in this inter-process communication. This allowed a crafted link to be interpreted as multiple instructions, rather than a single one.

Exploiting Internal URI Scheme

The injected commands targeted an internal URI scheme, `interpret:`, which is designed to read a specified file and send it to a chat. Crucially, this scheme lacked checks for who initiated the request and did not require user confirmation before transmitting the file.

Combining the injection flaw with this internal URI scheme allowed an attacker to turn a simple clicked link into an arbitrary file read operation, effectively stealing files from the victim's system.

Mechanism of Attack

When Telegram Desktop is already running, a newly launched instance (triggered by clicking a `tg://` link) acts as a client and attempts to connect to the existing instance (the server) via a local socket. The link's URL object is serialized into a text string for transmission across this socket.

Telegram uses a custom serialization format where each instruction is a keyword, its argument, and a semicolon terminator. The vulnerability arose because the semicolon was not properly escaped, allowing an attacker to inject additional commands into the serialized string.

Impact

This vulnerability meant that a user clicking a malicious link could unknowingly have their files, including sensitive login information, exfiltrated. The lack of confirmation prompts made the attack stealthy and effective.