ms-teams-rce

I'm surprised Microsoft didn't categorise it as "Important, Spoofing". https://github.com/oskarsve/ms-teams-rce/blob/main/README.md

> A phishing email which can pwn you without user interaction is basically unheard of. If you extend from "email" to the other communication tools that companies use today (and do use for inter-company communications too), there actually have been a number of these in the past year. Outlook [3] had one that didn't require downloading the file, exactly - the "Preview" window from just clicking the attachment once, was enough. Microsoft Teams [0], Jabber [1] and Slack [2] were all hit by real 0-interaction RCEs. [0] https://github.com/oskarsve/ms-teams-rce/blob/main/README.md [1] https://nvd.nist.gov/vuln/detail/CVE-2020-3495 [2] https://hackerone.com/reports/783877 [3] https://nvd.nist.gov/vuln/detail/CVE-2020-1349

> They tend to react with "either you can show us that this is a real danger or we'll ignore it". This is a bit of a Catch-22 situation, as I get the feeling that proving the danger would often involve doing things that bounty programs specifically forbid, such as "Moving beyond “proof of concept” repro steps"[0]. That may be part of the reason why Microsoft got away with such a stingy response to the RCE vulnerability found in Teams by Oskars Vegeris.[1] [0] https://www.microsoft.com/en-us/msrc/bounty-online-services?... [1] https://github.com/oskarsve/ms-teams-rce/blob/main/README.md

There's another angle to this that was discussed on the Risky Business[0] podcast a while back, namely the security angle. As the recent Microsoft Team's vulnerability[1] illustrated, with many Electron apps any XSS vulnerability turns into RCE. Personally I am moving away from Slack, Discord, and other electron apps like them. The browser sandbox ensures that XSS is "only" XSS and doesn't turn into RCE as well. 0: https://www.risky.biz/ 1: https://github.com/oskarsve/ms-teams-rce

Could you put that in the README, is what we're asking, as vague as it may be. At the moment the 'has been fixed' is the only clue to this in terms of resolution, and it's tucked away; without it it looks like most of the README is attempting to capitalize on the shock/outrage factor. Edit: Thanks, author has added some dates. https://github.com/oskarsve/ms-teams-rce/commit/35eac619fdef...