- Published on
Telegram Desktop vulnerability allowed any user's file to be stolen
- Authors
- Name
- DeepHorus
A newly disclosed vulnerability in Telegram Desktop allowed attackers to steal arbitrary files, including session files that grant full account access, by tricking a user into clicking a crafted link in a chat. The flaw combined an IPC injection with an internal URI handler, turning a single click into a remote file read. The attack required no user confirmation beyond the initial click. It highlights risks in desktop apps that register custom URI schemes.
Telegram Desktop registers the tg:// URI scheme so the operating system can launch it for links. When Telegram is already running, a new process connects to a local socket and sends the link as serialized text. The running instance deserializes by splitting on semicolons, each segment treated as a separate command. This design assumes values contain no semicolons, but they are not escaped.
The first defect is that unescaped separator. A crafted tg:// link can include a semicolon inside a query parameter, causing the new process to serialize it as one URL. The running instance then splits it into multiple instructions. An attacker can inject a second command after the legitimate OPEN: command. In the source, an example injects CMD:, but CMD: only accepts show and quit, limiting damage.
The second defect is the interpret: URI scheme. Telegram accepts four commands total; three are harmless. The fourth, OPEN:, accepts any URL without filtering. More critically, the interpret: scheme reads a file named in an instruction file and sends it to a chat. It does not verify who requested the action and asks for no confirmation. This turns injected commands into arbitrary file read.
Chaining both defects, an attacker can add a victim to a Telegram group, post a link, and wait for a click. The injected interpret: command reads local files and sends them to an attacker-controlled chat. The most sensitive target is Telegram's session files, which store login credentials. With those files, an attacker can take over the account.
The researcher's analysis describes the chain as one-click account takeover via IPC injection. The attack works because the new process treats the semicolon as part of a single URL, while the running instance treats it as a command separator. The local socket carries bytes, not objects, so serialization is unavoidable. The vulnerability affects Telegram Desktop when the app is already running and listening on that socket.
Security experts say the case illustrates a common pitfall: serialization formats that use delimiters without escaping. Custom URI schemes also expand attack surface because they bridge external links to internal commands. Desktop apps that handle sensitive sessions should validate every command and require user consent for file reads. The incident adds to pressure on messaging clients to harden IPC.
A fix would require escaping the separator and restricting interpret: to trusted contexts. Users should update Telegram Desktop promptly and avoid clicking unexpected tg:// links. Until fixes are confirmed, session files remain a high-value target. The disclosure underscores that even well-audited apps can suffer from simple parsing mistakes.
