CVE-2017-5592: Improper Input Validation (CWE-20)
value: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for profanity (0.4.7 - 0.5.0).
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 5.9
Published: 2017-02-09T20:59Z
Repository: https://github.com/boothj5/profanity
Language: C
Files changed: src/xmpp/message.c, tests/functionaltests/test_carbons.c
Commit date: 2017-01-23 22:25:36 +0000
Commit message: Add carbons from check

Diff: diff --git a/src/xmpp/message.c b/src/xmpp/message.c
index 9d80fb1f..3f8ad5a0 100644
--- a/src/xmpp/message.c
+++ b/src/xmpp/message.c
@@ -712,19 +712,26 @@ _handle_carbons(xmpp_stanza_t *const stanza)
     if (!message_txt) {
         log_warning("Carbon received with no message.");
         return TRUE;
     }
 
+    Jid *my_jid = jid_create(connection_get_fulljid());
+    const char *const stanza_from = xmpp_stanza_get_from(stanza);
+    Jid *msg_jid = jid_create(stanza_from);
+    if (g_strcmp0(my_jid->barejid, msg_jid->barejid) != 0) {
+        log_warning("Invalid carbon received, from: %s", stanza_from);
+        return TRUE;
+    }
+
     const gchar *to = xmpp_stanza_get_to(message);
     const gchar *from = xmpp_stanza_get_from(message);
 
     // happens when receive a carbon of a self sent message
     if (!to) to = from;
 
     Jid *jid_from = jid_create(from);
     Jid *jid_to = jid_create(to);
-    Jid *my_jid = jid_create(connection_get_fulljid());
 
     // check for pgp encrypted message
     char *enc_message = NULL;
     xmpp_stanza_t *x = xmpp_stanza_get_child_by_ns(message, STANZA_NS_ENCRYPTED);
     if (x) {
diff --git a/tests/functionaltests/test_carbons.c b/tests/functionaltests/test_carbons.c
index 414284ff..7926a76f 100644
--- a/tests/functionaltests/test_carbons.c
+++ b/tests/functionaltests/test_carbons.c
@@ -68,11 +68,11 @@ receive_carbon(void **state)
     assert_true(prof_output_exact("Buddy1 (mobile) is online, \"On my mobile\""));
     prof_input("/msg Buddy1");
     assert_true(prof_output_exact("unencrypted"));
 
     stbbr_send(
-        "<message type='chat' to='stabber@localhost/profanity' from='buddy1@localhost'>"
+        "<message type='chat' to='stabber@localhost/profanity' from='stabber@localhost'>"
             "<received xmlns='urn:xmpp:carbons:2'>"
                 "<forwarded xmlns='urn:xmpp:forward:0'>"
                     "<message id='prof_msg_7' xmlns='jabber:client' type='chat' lang='en' to='stabber@localhost/profanity' from='buddy1@localhost/mobile'>"
                         "<body>test carbon from recipient</body>"
                     "</message>"

Vulnerable code:     Jid *my_jid = jid_create(connection_get_fulljid());
        "<message type='chat' to='stabber@localhost/profanity' from='buddy1@localhost'>"
Fixed code:     Jid *my_jid = jid_create(connection_get_fulljid());
    const char *const stanza_from = xmpp_stanza_get_from(stanza);
    Jid *msg_jid = jid_create(stanza_from);
    if (g_strcmp0(my_jid->barejid, msg_jid->barejid) != 0) {
        log_warning("Invalid carbon received, from: %s", stanza_from);
        return TRUE;
    }

        "<message type='chat' to='stabber@localhost/profanity' from='stabber@localhost'>"