Recently, the team of TeamViewer has released its one of the new versions of its software with a security patch for a critical vulnerability, and the bug allowed hackers to steal the system passwords remotely.
TeamViewer is one of the comprehensive remote control tools that allow users to share desktop, online meetings, file transfer, and much more. The vulnerability that has been patched recently in the new version is named as CVE-2020-13699.
TeamViewer has many users from different sectors, like business organizations, educational institutions, private meetings, and many others. This newly detected vulnerability arises from the Desktop for Windows app, and it is not accurately requesting its custom uniform resource identifier (URI) handlers.
Iframes and URI schemes used
The iframes and URI schemes are not that difficult to execute, as the users will require to survey an ill-disposed page that stores an iframe in their web browser, perhaps it may be hidden or as small as a pixel, to avoid being recognized by a random surfer.
After that, the iframe gets loaded by itself, and it uses the URI scheme that asks your web browser to install the TeamViewer app.
The locally installed applications generally use the URI schemes; this accommodates the app to launch the iframes from the web browser. To begin the attack, the threat actor could easily convince the victim with TeamViewer installed on their system.
Here, what the users have to do is to tap on the URL of a website, and then, it provides a chance for the threat actors to execute all these attacks.
“An attacker could embed a malicious iframe in a website with a crafted URL () that would launch the TeamViewer Windows desktop client and force it to open a remote SMB share.</p>”
Affected URI handlers
Here, we have mentioned the affected URI handlers below:-
- teamviewer10
- teamviewer8
- teamviewerapi
- tvchat1
- tvcontrol1
- tvfiletransfer1
- tvjoinv8
- tvpresent1
- tvsendfile1
- tvsqcustomer1
- tvsqsupport1
- tvvideocall1
- tvvpn1
Affected platforms
- Windows
- macOS
- Linux
- Chrome OS
- iOS
- Android
- Windows RT,
- Windows Phone 8
- BlackBerry
About the vulnerability (CVE-2020-13699)
- Product: TeamViewer Windows Desktop App
- Developer: TeamViewer GmbH
- Vulnerability: Unquoted URI handler
- Affected Versions: Versions < 8.0.258861, 9.0.258860, 10.0.258873, 11.0.258870, 12.0.258869, 13.2.36220, 14.2.56676, 14.7.48350, and 15.8.3.
As we told earlier that CVE-2020-13699 vulnerability has arisen from the desktop for the Windows app, and the expert said that this flaw is occurring due to the incorrect extraction of custom URI handlers.
This vulnerability could be exploited when the system with an insecure version of TeamViewer is installed, as it visits an ill-disposed crafted website. Moreover, the experts said that the exploitation of the flaw could be started remotely as it doesn’t need any previous authentication.
This vulnerability attacks the TeamViewer versions of 8 to 15 for the Windows platform. That’s why the security experts strongly suggested the users upgrade their existing old version to 15.8.3 to seal the security hole, as it’s simply a matter of time before hackers began exploiting the flaw to hack into users’ Windows PCs and computers.
you can
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.
