CVE-2017-5592: Origin Validation Error (CWE-346)
value: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for profanity (0.4.7 - 0.5.0).
CWE description: The product does not properly verify that the source of data or communication is valid.
CVSS v3 base score: 5.9
Published: 2017-02-09T20:59Z
Repository: https://github.com/boothj5/profanity
Language: C
Files changed: src/xmpp/message.c, tests/functionaltests/test_carbons.c
Commit date: 2017-01-23 22:25:36 +0000
Commit message: Add carbons from check

Diff: diff --git a/src/xmpp/message.c b/src/xmpp/message.c
index 9d80fb1f..3f8ad5a0 100644
--- a/src/xmpp/message.c
+++ b/src/xmpp/message.c
@@ -712,19 +712,26 @@ _handle_carbons(xmpp_stanza_t *const stanza)
     if (!message_txt) {
         log_warning("Carbon received with no message.");
         return TRUE;
     }
 
+    Jid *my_jid = jid_create(connection_get_fulljid());
+    const char *const stanza_from = xmpp_stanza_get_from(stanza);
+    Jid *msg_jid = jid_create(stanza_from);
+    if (g_strcmp0(my_jid->barejid, msg_jid->barejid) != 0) {
+        log_warning("Invalid carbon received, from: %s", stanza_from);
+        return TRUE;
+    }
+
     const gchar *to = xmpp_stanza_get_to(message);
     const gchar *from = xmpp_stanza_get_from(message);
 
     // happens when receive a carbon of a self sent message
     if (!to) to = from;
 
     Jid *jid_from = jid_create(from);
     Jid *jid_to = jid_create(to);
-    Jid *my_jid = jid_create(connection_get_fulljid());
 
     // check for pgp encrypted message
     char *enc_message = NULL;
     xmpp_stanza_t *x = xmpp_stanza_get_child_by_ns(message, STANZA_NS_ENCRYPTED);
     if (x) {
diff --git a/tests/functionaltests/test_carbons.c b/tests/functionaltests/test_carbons.c
index 414284ff..7926a76f 100644
--- a/tests/functionaltests/test_carbons.c
+++ b/tests/functionaltests/test_carbons.c
@@ -68,11 +68,11 @@ receive_carbon(void **state)
     assert_true(prof_output_exact("Buddy1 (mobile) is online, \"On my mobile\""));
     prof_input("/msg Buddy1");
     assert_true(prof_output_exact("unencrypted"));
 
     stbbr_send(
-        "<message type='chat' to='stabber@localhost/profanity' from='buddy1@localhost'>"
+        "<message type='chat' to='stabber@localhost/profanity' from='stabber@localhost'>"
             "<received xmlns='urn:xmpp:carbons:2'>"
                 "<forwarded xmlns='urn:xmpp:forward:0'>"
                     "<message id='prof_msg_7' xmlns='jabber:client' type='chat' lang='en' to='stabber@localhost/profanity' from='buddy1@localhost/mobile'>"
                         "<body>test carbon from recipient</body>"
                     "</message>"

Vulnerable code:     Jid *my_jid = jid_create(connection_get_fulljid());
        "<message type='chat' to='stabber@localhost/profanity' from='buddy1@localhost'>"
Fixed code:     Jid *my_jid = jid_create(connection_get_fulljid());
    const char *const stanza_from = xmpp_stanza_get_from(stanza);
    Jid *msg_jid = jid_create(stanza_from);
    if (g_strcmp0(my_jid->barejid, msg_jid->barejid) != 0) {
        log_warning("Invalid carbon received, from: %s", stanza_from);
        return TRUE;
    }

        "<message type='chat' to='stabber@localhost/profanity' from='stabber@localhost'>"