CVE-2020-24772

Name of the Vulnerable Software and Affected Versions Dreamacro Clash for Windows version 0.11.4 Dreamacro version 1.1.0

Description The issue allows an attacker to embed a malicious iframe in a website with a crafted URL, launching the Clash Windows client and forcing it to open a remote SMB share. When opening the SMB share, Windows performs NTLM authentication, and this request can be relayed for code execution or captured for hash cracking.

Recommendations For Dreamacro Clash for Windows version 0.11.4, consider disabling the automatic launch of the Clash Windows client from crafted URLs as a temporary workaround until a patch is available. For Dreamacro version 1.1.0, restrict access to remote SMB shares to minimize the risk of exploitation.