Improper input validation in Sidequestvr Sidequest
CVE-2024-21625
SideQuest is a place to get virtual reality applications for Oculus Quest. The SideQuest desktop application uses deep links with a custom protocol (`sidequest://`) to trigger actions in the application from its web contents. Because, prior to version 0.10.35, the deep link URLs were not sanitized properly in all cases, a one-click remote code execution can be achieved in cases when a device is connected, the user is presented with a malicious link and clicks it from within the application. As of version 0.10.35, the custom protocol links within the electron application are now being parsed and sanitized properly.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (56.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 56th percentile — 56.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Sidequestvr Sidequest — versions < 0.10.35
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/SideQuestVR/SideQuest/security/advisories/GHSA-3v86-cf9q-x4x7 (Vendor Advisory)
Frequently asked questions
- What is CVE-2024-21625?
- CVE-2024-21625 is a high-severity vulnerability in Sidequestvr Sidequest, classified under Improper Input Validation. CVSS score: 8.8/10. Published 2024-01-04.
- How severe is CVE-2024-21625?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2024-21625 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.