CVE-2019-11354

moderate-risk
Published 2019-04-19

The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices communication.

Do I need to act?

!
40.7% chance of exploitation in next 30 days
EPSS score — higher than 59% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
47021
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.8/10 High
LOCAL / LOW complexity

Affected Products (1)

Affected Vendors

Ea

References (24)

Third Party Advisory http://gamasutra.com/view/news/340907/A_nowfixed_Origin_vulnerability_potentiall...
Exploit http://packetstormsecurity.com/files/153375/dotProject-2.1.9-SQL-Injection.html
Exploit http://packetstormsecurity.com/files/153485/EA-Origin-Template-Injection-Remote-...
Broken Link https://blog.underdogsecurity.com/rce_in_origin_client/
Exploit https://gizmodo.com/ea-origin-users-update-your-client-now-1834079604
Exploit https://techcrunch.com/2019/04/16/ea-origin-bug-exposed-hackers/
Press/Media Coverage https://www.golem.de/news/sicherheitsluecke-ea-origin-fuehrte-schadcode-per-link...
Press/Media Coverage https://www.pcmag.com/news/367801/security-flaw-allowed-any-app-to-run-using-eas...
Press/Media Coverage https://www.techradar.com/news/major-security-flaw-found-in-ea-origin-gaming-cli...
Press/Media Coverage https://www.thesun.co.uk/tech/8877334/sims-4-battlefield-fifa-origin-hackers/
Third Party Advisory https://www.trustedreviews.com/news/time-update-origin-eas-game-client-security-...
Third Party Advisory https://www.vg247.com/2019/04/17/ea-origin-security-flaw-run-malicious-code-fixe...
Third Party Advisory http://gamasutra.com/view/news/340907/A_nowfixed_Origin_vulnerability_potentiall...
Exploit http://packetstormsecurity.com/files/153375/dotProject-2.1.9-SQL-Injection.html
Exploit http://packetstormsecurity.com/files/153485/EA-Origin-Template-Injection-Remote-...
Broken Link https://blog.underdogsecurity.com/rce_in_origin_client/
Exploit https://gizmodo.com/ea-origin-users-update-your-client-now-1834079604
Exploit https://techcrunch.com/2019/04/16/ea-origin-bug-exposed-hackers/
Press/Media Coverage https://www.golem.de/news/sicherheitsluecke-ea-origin-fuehrte-schadcode-per-link...
Press/Media Coverage https://www.pcmag.com/news/367801/security-flaw-allowed-any-app-to-run-using-eas...
and 4 more references
46
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 17/34 · Moderate
Exposure 5/34 · Minimal