Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
One-click remote code execution via malicious deep link
Vulnerability Description
SideQuest is a place to get virtual reality applications for Oculus Quest. The SideQuest desktop application uses deep links with a custom protocol (`sidequest://`) to trigger actions in the application from its web contents. Because, prior to version 0.10.35, the deep link URLs were not sanitized properly in all cases, a one-click remote code execution can be achieved in cases when a device is connected, the user is presented with a malicious link and clicks it from within the application. As of version 0.10.35, the custom protocol links within the electron application are now being parsed and sanitized properly.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability Type
输入验证不恰当
Vulnerability Title
SideQuest 输入验证错误漏洞
Vulnerability Description
SideQuest是SideQuest开源的一个游戏商店应用程序。 SideQuest 0.10.35之前版本存在输入验证错误漏洞，该漏洞源于允许攻击者通过恶意深度链接实现一键远程执行代码。
CVSS Information
N/A
Vulnerability Type
N/A