CVE-2024-20396: Cisco Webex Teams Information Disclosure

CVE-2024-20396 Overview

CVE-2024-20396 is an information disclosure vulnerability in the protocol handlers of the Cisco Webex App (formerly Webex Teams). The flaw allows an unauthenticated, remote attacker to coerce the application into sending requests to attacker-influenced destinations. An adversary in a privileged network position can then capture sensitive data, including credential material, from those requests. Exploitation requires user interaction, typically clicking a crafted link that invokes a file protocol handler. The vulnerability is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
A successful exploit discloses credential information transmitted by the Webex App when a user follows a malicious link, enabling downstream account compromise.

Affected Products

Cisco Webex App (Webex Teams) 3.0.x release train, including builds 3.0.13464.0 through 3.0.16285.0
Cisco Webex App 42.x releases, including 42.1.0.21190 through 42.12.0.24485
Cisco Webex App 43.x releases up to 43.4.0.25788

Discovery Timeline

2024-07-17 - CVE-2024-20396 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD

Technical Details for CVE-2024-20396

Vulnerability Analysis

The Cisco Webex App registers custom protocol handlers with the host operating system to support deep linking into meetings, chats, and shared resources. The affected versions do not safely validate URIs passed through file-scheme handlers. When the application processes a crafted URI, it issues outbound requests that include session or credential data in request headers or bodies. An attacker who can observe network traffic between the client and the destination can capture that material. The weakness is categorized as [CWE-200] information exposure and is network-reachable, requiring only that the victim follow a link.

Root Cause

The root cause is unsafe handling of file protocol handlers invoked by the Webex App URI parser. The application accepts attacker-controlled parameters that influence the destination of subsequent requests. Because sensitive authentication material is attached to these requests, redirection to an attacker-observable endpoint results in disclosure.

Attack Vector

Exploitation begins with social engineering. The attacker delivers a link, through email, chat, or a web page, that invokes a Webex protocol handler with crafted parameters. When the user clicks the link, the Webex App issues an outbound request containing credential data. An attacker positioned to observe transmitted traffic, for example on a shared network segment or through traffic redirection, captures the request contents. Full technical details are available in the Cisco Security Advisory for Webex App.

No verified public proof-of-concept exploit is available for this vulnerability. Refer to the Cisco advisory for technical specifics.

Detection Methods for CVE-2024-20396

Indicators of Compromise

Outbound HTTP or HTTPS requests from the Webex App process to domains that do not match Cisco Webex infrastructure.
Unexpected invocations of the webex:// or webexteams:// protocol handler originating from browser or mail client processes.
Credential or token values appearing in network capture metadata associated with Webex App traffic.

Detection Strategies

Inspect proxy and firewall logs for Webex App user-agent traffic directed to non-Cisco domains.
Correlate URL click events in email security gateways with subsequent Webex App network activity on the same endpoint.
Hunt for process launches where a browser or mail client spawns the Webex App with a long or encoded URI argument.

Monitoring Recommendations

Enable TLS inspection on egress proxies to validate destinations contacted by the Webex App.
Alert on Webex App versions below the fixed release reported by endpoint inventory tooling.
Log and review Windows registry or macOS Launch Services entries associated with Webex protocol handler registration.

How to Mitigate CVE-2024-20396

Immediate Actions Required

Upgrade the Cisco Webex App to a fixed release as identified in the Cisco Security Advisory.
Inventory all endpoints running Webex App builds in the 3.0.x, 42.x, or 43.x trains listed above and prioritize them for patching.
Rotate credentials for any user who followed suspicious Webex links on a vulnerable client version.

Patch Information

Cisco released fixed versions of the Webex App that correct protocol handler processing. Administrators should consult the Cisco Security Advisory: cisco-sa-webex-app-ZjNm8X8j for the fixed release matrix that corresponds to each deployed branch and apply upgrades through managed software distribution.

Workarounds

Cisco has not published a configuration workaround; upgrading to a fixed release is required.
Train users to avoid clicking unsolicited webex:// or webexteams:// links from untrusted sources.
Require VPN or encrypted transport for roaming users to reduce exposure to privileged network observers on untrusted segments.

bash

# Example: query installed Webex App version on Windows endpoints via PowerShell
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like 'Webex*' } |
  Select-Object DisplayName, DisplayVersion, InstallLocation