ZDI-19-252: Unity com.unity3d.kharma Protocol Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Unity Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handler for the com.unity3d.kharma protocol. A crafted URI with the com.unity3d.kharma protocol can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of the current user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-19-252?
ZDI-19-252 has been classified with a high severity due to its potential to allow remote attackers to execute arbitrary code.
How do I fix ZDI-19-252?
To fix ZDI-19-252, update your installation of Unity Editor to the latest version provided by Unity Technologies.
What kind of attack is associated with ZDI-19-252?
ZDI-19-252 can be exploited through user interaction, such as visiting a malicious webpage or opening a malicious file.
What versions of Unity are affected by ZDI-19-252?
ZDI-19-252 affects vulnerable installations of the Unity Editor prior to the security update from Unity Technologies.
Is user interaction required to exploit ZDI-19-252?
Yes, user interaction is required to exploit ZDI-19-252.