The vulnerability, which resides in Messenger version 460.16, could allow attackers to leverage the app to potentially execute malicious files already present on a compromised system in an attempt to help malware gain persistent/extended access.
Reason Labs shared its findings with Facebook in April, after which the social media company quickly patched the flaw with the release of an updated version of Facebook Messenger for Windows users via the Microsoft store.
According to researchers, the vulnerable app triggers a call to load Windows Powershell from the C:\python27 path. This path is typically created when installing version 2.7 of the Python and does not commonly exist in most Windows installations.
Attackers can hijack such calls that attempt to load potentially non-existent resources to covertly execute malware. Moreover, since the targeted directory is also in a low-integrity location, malicious programs could access the path without administrator privileges.
To test if the flaw is exploitable, the team created a reverse shell disguised as Powershell.exe and deployed it into the Python directory. They then ran the Messenger app, which triggered the call, successfully executing the reverse shell, thus proving that malicious actors could exploit the flaw for persistent attacks.
Conventionally, attackers employing persistence methods rely on registry keys, scheduled tasks, and services to maintain active access to a system. This particular type of vulnerability is considered to be more complex to exploit.
Attackers need to observe if an app is making an unwanted call or dive deep into an app's binary code to find a function that makes such a call.
The vulnerability has been fixed in version 480.5, which is the most recent release that Reason tested. Users who are running the flawed version should update to the latest release.
While there has been no indication that the flaw has been exploited before Reason's discovery, such vulnerabilities are highly risky.
Malicious actors can use such flaws to maintain access to devices for extended periods. Such persistent access can allow them to perform other hacks, including ransomware implantation and data exfiltration and breaches.
Threat groups also use persistent methods to perform specialized hacks targeting financial institutions, government offices, and other industrial facilities.
In addition, the threat could have been widespread had the vulnerability been exploited. Facebook Messenger has 1.3 billion active users a month. While this figure accounts for all users across devices, many access the service through their Windows-based machines.
This becomes even more worrying considering that messaging apps are seeing significant use during the ongoing coronavirus pandemic. Due to travel restrictions, lockdowns, and forced work-from-home arrangements, users rely heavily on messaging apps and video conferencing tools to communicate and collaborate.
Facebook's Messenger is among the popularly used apps. In March, Facebook reported a 50 percent increase in messaging and a 1,000 percent increase in time-in-group in calls with three or more participants.
