Progress Telerik Fiddler Download & Setup Skill runs unverified downloaded code
A web debugging tool's installer can be made to install attackers' code.
Summary
The Progress Telerik Fiddler Download & Setup Skill runs downloaded installers without checking them. If a release component is compromised, attacker code can run when a user runs the skill, and on macOS the package is installed with administrator rights, so root-level code execution is possible.
Affected when
- Running a copy of the Fiddler Download & Setup Skill
- On macOS, approving the administrator install prompt
What to do
Do not run an existing copy. Remove old copies and get the latest from the official fiddler-agent-tools repository, then reinstall the skill. Updating the Fiddler Everywhere app alone does not replace the skill. If you cannot change it now, install Fiddler manually from the official distribution source and verify the publisher signature and checksum.
Products and platforms
CVE IDs
Sources
- Advisory: telerik.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen