Researchers from ExPatch LLC identified a vulnerability in Telegram Desktop that allows a malicious proxy server to trigger NTLM authentication without user consent. The issue stems from the application's reliance on the Qt library for proxy connection handling, specifically within the QTcpSocket and QAuthenticator components.
By sending a 407 Proxy Authentication Required response with a Proxy-Authenticate: NTLM header, an attacker can force the application to initiate an NTLM handshake. Because the Qt library fails to perform proper integrity checks or verify the proxy's identity, it automatically uses the user's system credentials via Windows SSPI.
The vulnerability enables NTLM Relay attacks, potentially allowing an attacker to gain control over the device with SYSTEM privileges. The researchers confirmed that the application does not prompt the user for credentials or provide a mechanism to block the authentication request when the NTLM scheme is triggered.
ExPatch reported the findings to Telegram on June 6, 2024. While the issue was subsequently patched in the Qt library, the researchers noted that they were not involved in the coordination process and were not credited in the public disclosure.
The analysis was conducted on Telegram Desktop version 6.8.4 using Qt 6.11.1. The researchers previously discovered an XSS vulnerability in the chat export function of the same application, highlighting ongoing security concerns regarding the proxy subsystem.
