Description
Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge. Attackers exploiting a Discord XSS can set additionalArguments to persistently add --proxy-server and --ignore-certificate-errors switches, routing all client traffic through an interception proxy.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Legcord Legcord
Default version status: unaffected
1.1.0 to ≤ 1.3.0affected
References
- https://github.com/Legcord/Legcord/issues/1163 ↗
- https://github.com/Legcord/Legcord ↗
- https://github.com/Legcord/Legcord/blob/v1.3.0/src/discord/ipc.ts#L296-L299 ↗
- https://github.com/Legcord/Legcord/blob/v1.3.0/src/main.ts#L277-L307 ↗
- https://www.vulncheck.com/advisories/legcord-1.1.0-through-1.3.0-chromium-switch-injection-via-settings-setconfig ↗