SecBoard
Zurück zur CVE-Übersicht

CVE-2026-92299

HIGH(7.4)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Risk Signal Score19/100 — NIEDRIG
  • CVSS 7.4 — Hoch

EPSS-Score

0.5%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

7.4

Technische Schwere

Beschreibung

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop thumbnails at arbitrary resolution without user consent or operating system permission prompts.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 10.0.5

Threat-Hunting-Queries

Detects attempts to enumerate desktop sources or retrieve desktop thumbnails without explicit user consent, focusing on the jitsi-screen-sharing-get-sources IPC route.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "jitsi-screen-sharing-get-sources" or ProcessCommandLine contains "jitsi-screen-sharing-get-sources"
| where InitiatingProcessParentFileName != "electron.exe" // Adjust based on legitimate parent processes if known
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine, InitiatingProcessParentFileName

Splunk SPL

(sourcetype=process_events OR sourcetype=sysmon_events) (CommandLine="*jitsi-screen-sharing-get-sources*" OR ParentCommandLine="*jitsi-screen-sharing-get-sources*") NOT ParentProcessName="electron.exe" | table _time, host, Image, CommandLine, ParentImage, ParentCommandLine

Sigma

title: Jitsi Electron SDK Unauthorized Screen Capture Attempt
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects attempts to exploit CVE-2026-92299 in Jitsi Electron SDK by calling the jitsi-screen-sharing-get-sources IPC route without user consent.
author: SecBoard
date: 2024/07/30
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: 'jitsi-screen-sharing-get-sources'
  filter:
    ParentImage|endswith: '\electron.exe'
  condition: selection and not filter
fields:
  - CommandLine
  - ParentCommandLine
  - Image
  - ParentImage
tags:
  - attack.t1113 # Screen Capture
  - cve.2026.92299
  - cwe.862
level: high

Elastic ES|QL

FROM process
WHERE process.args : "*jitsi-screen-sharing-get-sources*"
  AND NOT process.parent.executable.name : "electron.exe"
SELECT @timestamp, host.name, process.executable, process.command_line, process.parent.executable, process.parent.command_line

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Sonstige (1)

  • jitsi-screen-sharing-get-sources IPC route

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen