As revealed, the vulnerability specifically existed in the Facebook Messenger for Windows. This is the desktop version of the app available on Microsoft Store.
The bug existed because this specific app version executed an unusual code that allowed an adversary to gain persistent access to the target device.
As explained in the post,
The app executes code that shouldn’t be executed, resulting in a vulnerability that allows attackers to hijack a call for a resource within the Messenger code in order to run their malware.Explaining further about the flaw, the researchers state,
Reason research team found a strange call to load the Powershell.exe from the Python27 directory. When we saw that, we knew we found something since the location of “Python27” is in the “c:\python27” directory, which is a low-integrity location. This means that every malicious program can access the path without any admin privileges.Exploiting this vulnerability could hence facilitate the attacker to run malware on the target machine for extended durations.
The researchers have shared the PoC exploit in their post.
Following their report, Facebook patched the flaw with the release of version 480.5. Since this version is available on Microsoft Store, users can simply update their devices to the latest version to stay safe.
Let us know your thoughts in the comments.
