CVE-2018-20436 Explained : Impact and Mitigation

Telegram version 4.9.1 for Android and other products have a security issue related to the "secret chat" feature, potentially leading to Server-Side Request Forgery (SSRF) problems.

Understanding CVE-2018-20436

This CVE involves a side channel in Telegram's secret chat feature that triggers GET requests to URLs typed during chat composition, even before sending the message.

What is CVE-2018-20436?

The vulnerability in Telegram version 4.9.1 for Android and other products allows Telegram servers to make GET requests for URLs typed during chat creation, potentially leading to SSRF issues.

The Impact of CVE-2018-20436

Unauthorized access to URLs typed in secret chats
Potential SSRF attacks
Misconfiguration of the "Secret chats > Preview links" setting may lead to unwanted behavior

Technical Details of CVE-2018-20436

The technical aspects of this CVE include:

Vulnerability Description

Telegram servers making GET requests for URLs typed in secret chats
Triggering GET requests to URLs on the same web server

Affected Systems and Versions

Telegram version 4.9.1 for Android
Telegram Web version 0.7.0

Exploitation Mechanism

Exploiting the side channel in the secret chat feature to intercept URLs

Mitigation and Prevention

Steps to address and prevent exploitation of CVE-2018-20436:

Immediate Steps to Take

Disable the "Secret chats > Preview links" setting
Avoid sharing sensitive information in secret chats

Long-Term Security Practices

Regularly update Telegram to the latest version
Educate users on secure communication practices

Patching and Updates

Apply patches and updates provided by Telegram to fix the SSRF vulnerability