Researchers Detail Now-Patched WhatsApp Vulnerability
In a recent post made by the security researchers working with Check Point, a team disclosed an old vulnerability in a now-outdated version of WhatsApp that could have led to potential exposure of personal information of WhatsApp users.
The bug in question involves a pretty long and convoluted chain of events that needs to take place before any of the user's data becomes exploitable, but it was still given a rating of 7.8, which is considered 'high' under the CVE or Common Vulnerabilities and Exploits system.
In order for a bad actor to abuse the vulnerability in question, they would need to send a specifically doctored, maliciously constructed image file.
The victim would then need to run the received attachment file through one of the WhatsApp image manipulation filters. Once they attempt to send the resulting file back, the app could crash and lead to the data exposure.
The vulnerability is explained in great technical detail in the Check Point report but essentially boils down to WhatsApp not checking the both source and destination image. In cases when a maliciously doctored source image is used, this could lead to out of bounds read-write issues.
WhatsApp has the largest userbase among messaging apps, with around 2 billion monthly active users. Even considering the complex and relatively long chain of events and conditions that need to be satisfied for the exploit to trigger and expose the user's data, similar vulnerabilities are always an issues
After Check Point notified WhatsApp of the issue in late 2020, the bug was patches out and has been eliminated from the application starting with version 2.21.1.13.
Similar reports also help raise awareness about the importance of updating every application on every device you have as soon as possible after a new patch.
