HTTP: Electronic Arts Origin Client URI Handler Template Injection Remote Code Execution
This signature detects attempts to exploit a known vulnerability against Electronic Arts Origin Client. A successful attack can lead to arbitrary code execution.
Extended Description
The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices communication.
Affected Products
Ea origin
References
CVE: CVE-2019-11354
Short Name
HTTP:STC:CVE-2019-11354-RCE
Severity
Major
Recommended
True
Recommended Action
Drop
Category
HTTP
Keywords
Arts CVE-2019-11354 Client Code Electronic Execution Handler Injection Origin Remote Template URI
Release Date
07/18/2019
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3771
False Positive
Unknown
Vendors
Ea
CVSS Score
6.8