CVE-2021-34823
📋 TL;DR
CVE-2021-34823 is a critical vulnerability in ON24 ScreenShare for macOS that allows unauthenticated remote attackers to read local files and upload them to remote machines via an XXE flaw. The vulnerability affects macOS users running the vulnerable plugin version. Attackers can exploit this through crafted HTTP requests to the plugin's built-in HTTP server.
💻 Affected Systems
- ON24 ScreenShare (DesktopScreenShare.app)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the macOS system with exfiltration of sensitive files, credentials, and user data to attacker-controlled servers.
Likely Case
Unauthorized access to user documents, configuration files, and potentially sensitive data stored in accessible directories.
If Mitigated
Limited impact if the plugin is disabled or network access is restricted, though local file access remains a concern.
🎯 Exploit Status
Exploitation requires sending crafted HTTP requests to the vulnerable server, which is straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0
Vendor Advisory: https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29105
Restart Required: Yes
Instructions:
1. Download ON24 ScreenShare version 2.0 or later from the official vendor source. 2. Uninstall the previous version. 3. Install the updated version. 4. Restart the system to ensure changes take effect.
🔧 Temporary Workarounds
Disable ON24 ScreenShare Plugin
macOSCompletely disable or uninstall the vulnerable plugin to eliminate the attack surface.
sudo rm -rf /Applications/DesktopScreenShare.app
sudo launchctl unload /Library/LaunchDaemons/com.on24.screenshare.plist
Block Network Access
macOSUse firewall rules to block incoming HTTP requests to the ON24 ScreenShare server port.
sudo pfctl -f /etc/pf.conf
Add rule: block in proto tcp from any to any port <ON24_PORT>
🧯 If You Can't Patch
- Disable the ON24 ScreenShare plugin immediately and remove it from the system.
- Implement strict network segmentation and firewall rules to block all traffic to the ON24 service.
🔍 How to Verify
Check if Vulnerable:
Check if DesktopScreenShare.app exists in /Applications and verify its version is below 2.0.Check Version:
defaults read /Applications/DesktopScreenShare.app/Contents/Info.plist CFBundleShortVersionStringVerify Fix Applied:
Confirm DesktopScreenShare.app version is 2.0 or higher, or verify the application has been completely removed.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to the ON24 service port in system logs
- File access attempts from the ON24 process to sensitive directories
Network Indicators:
- HTTP traffic to unusual external IPs from the ON24 service
- Outbound file transfers initiated by the ON24 process
SIEM Query:
source="macos_system_logs" AND process="DesktopScreenShare" AND (event="http_request" OR event="file_access")🔗 References
- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/
- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29105
- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/
- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29105
