Android Telegram for Android attachment validation flaw disguises malicious apps as videos

EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android application affecting versions 10.14.4 and older.

• Affected product: vendor Android, product Telegram for Android, package org.telegram.messenger, Android platform. • CNA affected range: semver versions from 0 through and including 10.14.4. The default status outside that range is unaffected. • Fix: ESET stated that Telegram shipped 10.14.5 to fix the issue and confirmed that versions from that release onward correctly identify the shared file as an application rather than a video. • ESET reported that the tested exploit did not work on Telegram Web or Telegram Desktop, but those clients are not listed as affected products in the CNA data. Other branches or distributions not expressly covered should be verified separately.

Telegram for Android processes an attacker-controlled Android application file as multimedia content, causing it to be displayed as a video rather than as a binary attachment. ESET reported that the malicious payload could be delivered through Telegram channels, groups, or chats; on an affected client, the file could be downloaded automatically when a user opened the conversation if automatic media download was enabled. When the user tried to play the fake video, Telegram displayed an unable-to-play warning and suggested opening it with an external player; continuing could lead to a request to install the malicious application and enable installation from unknown sources. ESET speculated that the upload process may have been abused, but the precise server-side validation defect remains unconfirmed. ESET also stated that it could not reproduce the exploit independently and instead inspected and verified a sample obtained from the seller. The recorded weakness is CWE-20, Improper Input Validation.

The vulnerability can be reached over the network by sending a specially crafted attachment through Telegram. Successful exploitation requires user interaction, including opening the conversation, handling the fake video, and accepting application installation; ESET also described automatic payload download when a user opened a conversation with automatic media download enabled. The supplied assessments are not fully consistent about attacker privilege requirements, so the exact authentication precondition beyond the ability to deliver the payload is unresolved. ESET documented an exploit advertised for sale and analyzed a sample, but the record does not mark this vulnerability as known exploited. The returned enrichment records exploitation as none and automatable as no; that does not prove that no victim was ever targeted or that all exploitation activity would have been detected.

• Successful exploitation can cause a user to download and install a malicious Android application disguised as a video, allowing attacker-controlled code to run after the user approves installation. • The supplied assessments characterize the vulnerability as having substantial integrity and availability impact, while recording no direct confidentiality impact for the vulnerability itself. Whether a resulting payload can access data or perform other actions depends on that payload and its permissions and is not established here. • Organizational consequences may include unusable devices, unauthorized changes, investigation costs, and the need to reset or remediate affected devices. The returned enrichment describes the issue as not automatable and still dependent on user interaction.

• Users may install malware while believing they are opening a video, increasing the risk of loss of device integrity. • Organizations may need to investigate devices, isolate endpoints, remove suspicious applications, and respond to incidents on devices that received the payload. • The malicious payload may cause operational disruption or unauthorized changes on a device; specific data-access capabilities depend on the installed application and granted permissions and are not established by this record. • The recorded affected scope is the Telegram for Android client. ESET reported that its testing did not show the same exploit working on Telegram Web or Telegram Desktop, but the status of other clients or repackaged builds is not established by the record.

1. Update Telegram for Android to 10.14.5, which ESET identifies as the fixed release, or to a newer release delivered through the official update channel. Do not continue deploying versions 10.14.4 and older on devices that may receive untrusted Telegram content.
2. Until the update is installed, do not open suspicious Telegram videos when the application asks to use an external player, do not install an application presented as a video player, and do not enable installation from unknown sources merely to open media.
3. For managed fleets, use MDM or inventory tooling to identify package org.telegram.messenger, enforce updates, and track devices that have not reached the fixed release.
4. If a device may have interacted with a suspicious payload, isolate it according to the mobile-incident response process, inspect newly installed applications, and review application-installation telemetry. Use the sample and network indicators from ESET as supporting data, not as proof that a device is safe when no indicator is found.

• Inventory Android devices with package org.telegram.messenger and identify installations still within the affected version range described in affected_summary. • Review user reports and Telegram telemetry for unusual videos, unable-to-play messages, prompts to open content with an external player, or requests to enable installation from unknown sources. • Inspect download and application-installation history around Telegram activity, especially where an APK was presented as a video or other multimedia file. • Review MDM or mobile-security telemetry for changes allowing installation from unknown sources and newly installed applications following Telegram activity. Treat this as precautionary monitoring, not as a confirmed indicator specific to the vulnerability. • Use the sample and network indicators provided by ESET as supplementary detection data. The absence of an indicator does not prove that a device is safe.