Improper input validation in Sidequestvr Sidequest
CVE-2024-21625
SideQuest is a place to get virtual reality applications for Oculus Quest. The SideQuest desktop application uses deep links with a custom protocol (`sidequest://`) to trigger actions in the application from its web contents. Because, prior to version 0.10.35, the deep link URLs were not sanitized properly in all cases, a one-click remote code execution can be achieved in cases when a device is connected, the user is presented with a malicious link and clicks it from within the application. As of version 0.10.35, the custom protocol links within the electron application are now being parsed and sanitized properly.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.008 (54.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Sidequestvr Sidequest — versions < 0.10.35
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2024-21625?
- CVE-2024-21625 is a high-severity vulnerability in Sidequestvr Sidequest, classified under Improper Input Validation. CVSS score: 8.8/10. Published 2024-01-04.
- How severe is CVE-2024-21625?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2024-21625 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.