Meta’s popular chat platform, WhatsApp, has been found to exhibit a concerning feature. According to researcher Saumyajeet Das, the Windows version of WhatsApp does not issue security alerts when Python files are downloaded from chats. This flaw enables adversaries to send malicious scripts to WhatsApp users on Windows.
While WhatsApp typically blocks many file types like .exe and .bat files by showing warning prompts to mitigate security risks, it fails to do so for three specific file types: .PYZ (Python ZIP app), .PYZW (PyInstaller program), and .EVTX (Windows Event Log file).
After discovering this vulnerability, Das reported it to Meta through their bug bounty program. However, Meta did not classify it as a security flaw. They maintained that WhatsApp’s current alert system is adequate and emphasized user responsibility in handling files from unknown sources.
🚨 Major WhatsApp security flaw: Python and PHP files can execute without warning on Windows. Exe, Bat, Com, Scr also possible. Just clicking “Open” runs the script. This is heaven for remote code execution attacks.
Source: https://t.co/ePLhlEGmxy pic.twitter.com/eNwNrTICa0
— Zak Allal, MD (@ZakAllalMD) July 29, 2024
Meta stated, “Malware can take many different forms, including through downloadable files meant to trick a user… It’s why we warn users to never click on or open a file from somebody they don’t know, regardless of how they received it — whether over WhatsApp or any other app.”
Despite the potential risk of exploitation, especially following a WhatsApp account hijack, Meta does not plan to block Python and PHP files on WhatsApp for Windows. This stance is concerning given previous vulnerabilities that allowed account hijacking through WhatsApp calls or data theft.
Start Growing with Cloudways Today.
Our Clients Love us because we never compromise on these
Abdul Rehman
Abdul is a tech-savvy, coffee-fueled, and creatively driven marketer who loves keeping up with the latest software updates and tech gadgets. He's also a skilled technical writer who can explain complex concepts simply for a broad audience. Abdul enjoys sharing his knowledge of the Cloud industry through user manuals, documentation, and blog posts.
