Telegram Patches Critical Flaw After Over a Month of Exposure

In April, there were reports of a high-risk security vulnerability within the desktop version of the instant messaging app Telegram. Attackers could infect users by sending specially crafted media files that did not require any interaction from the user, exploiting Telegram's default setting of automatically downloading media files.

Today, researchers from the well-known security software developer ESET disclosed another high-risk security vulnerability in Telegram. This vulnerability had been discovered and exploited by hackers since at least June 6, and it wasn't until July 11 that Telegram patched it in version v10.14.5.

Telegram's Zero-Day Vulnerability:

Initially, ESET researchers found a hacker named Ancryno on a Russian XSS hacker forum selling this vulnerability. After conducting a proof of concept (PoC), ESET confirmed the vulnerability was genuine and only applicable to the Telegram for Android version.

Hackers could create a specially crafted APK file and send it to Telegram users. This file would appear as an embedded video, and if Telegram's setting to automatically download media files was enabled, it would be downloaded automatically.

When users tried to play the video, the Android system would prompt them with an "open" button, which, when clicked, would install the malicious APK file. However, this required the precondition that users had already enabled the installation of apps from unknown sources in their settings; otherwise, the system would alert users that they were attempting to open an APK file.

The Vulnerability Exposed for At Least Five Weeks:

Although ESET researchers disclosed this vulnerability to Telegram on June 26, the patching took a considerable amount of time. Telegram responded to ESET on July 4, saying they were investigating, and it wasn't until July 11 that a new version was released with the fix.

From June 6, when the hacker first posted, to July 11, the vulnerability was exploitable for over a month. Telegram did not disclose whether hackers actively exploited this vulnerability for attacks.

The vulnerability fundamentally resembles that found in the Telegram desktop version, both exploiting flaws in the Telegram API to disguise specially crafted files as media, enabling automatic downloading within Telegram.

We continue to advise Telegram users to disable the automatic media file download feature to prevent attackers from exploiting similar vulnerabilities for targeted attacks.