One-click remote code execution via malicious deep link

1. Summary

SideQuest is an Electron-based desktop application for sideloading virtual-reality apps onto Oculus/Meta Quest headsets, and it registers a custom sidequest:// deep-link protocol so its web contents can trigger in-app actions [2]. In versions before 0.10.35, these deep-link URLs were not sanitized properly in all cases before being processed, so a crafted link reaching a code-execution path constitutes an improper-input-validation defect (CWE-20) [1][2]. When a headset is connected and the victim clicks a malicious link from within the running application, an attacker achieves arbitrary code execution on the victim’s PC with a single click [2].

2. Affected products & versions

3. The vulnerability in detail

The flaw lives in the SideQuest desktop application, an Electron program used to browse, install, and manage sideloaded VR content on Oculus/Meta Quest headsets [1][2]. SideQuest’s architecture bridges a web-content layer — the storefront and UI rendered inside Electron — with native, in-app actions performed on the host machine. To let the web layer drive those native actions, SideQuest registers and handles a custom URL scheme, sidequest://. Deep links using this scheme are the intended mechanism by which the app’s web contents ask the desktop application to perform operations. This is the classic Electron pattern of exposing a privileged action surface to comparatively untrusted web content: the renderer (or a page loaded into it) requests, and the application-side handler performs, the actual work [1][2].

The root cause is that, prior to version 0.10.35, these sidequest:// deep-link URLs were not sanitized or validated properly in all cases before the application acted on them [1][2]. In other words, the custom-protocol handler accepted attacker-influenceable input and routed it into an in-app action path without adequately constraining what that input could express or which actions it could reach. This is a textbook instance of CWE-20, Improper Input Validation: the program receives input from an untrusted source — a link the victim is induced to click — and fails to verify that the input has the properties required for safe processing, so malformed or hostile input flows into a sensitive code path [2]. Because the deep-link surface is a bridge from web content into native desktop capability, a validation gap here does not merely corrupt data: it lets crafted input steer the application into executing attacker-chosen behavior [1][2]. The vendor fix in 0.10.35 is described precisely in these terms — the custom-protocol links within the Electron application are, as of that release, parsed and sanitized properly — which confirms both the location of the defect (custom-protocol link handling) and the class of fix (proper parsing/validation of the link before it is acted upon) [1].

The mechanism, as documented, is a one-click remote code execution [2]. The preconditions are specific and all three must hold: (1) the SideQuest desktop application is running on the victim’s PC at a version before 0.10.35; (2) a device — the headset — is connected to the computer; and (3) the victim clicks a malicious sidequest:// link that is presented from within the application [1][2]. The device-connected requirement reflects that the abused action path is one that is available or active when a headset is attached. The CVSS vector reinforces the picture: it is network-reachable (AV:N), of low attack complexity (AC:L), and requires no privileges (PR:N), but it does require user interaction (UI:R) — the single click. No authentication and no physical or RF adjacency are needed [2]. That combination is why the issue is scored “one-click” RCE rather than “zero-click”: the victim’s single in-app click is the only gating human action.

The exploitation chain is straightforward to describe even though the internal gadget is not published. The attacker first crafts a malicious sidequest:// deep-link URL that exploits the improper sanitization; the available sources document that the deep-link URLs are the unsanitized input but do not detail the exact payload or the specific in-app action abused to reach code execution [1][2]. The victim, running the vulnerable desktop app with a headset connected, is presented with the link and clicks it once. The unsanitized URL is then parsed and processed by the Electron application, yielding arbitrary code execution — the confidentiality, integrity, and availability impact captured by CVSS C:H/I:H/A:H [2]. Because the abused surface is a web-content-to-native bridge, the link does not have to originate from a trusted page: any context that can present the victim a clickable sidequest:// URL inside the running app is sufficient to reach the handler, which is what makes the network-reachable, user-interaction-only vector credible [1][2].

Beyond that PC-level code execution, one framing that appears in the analysis — a downstream pivot in which the attacker abuses SideQuest’s brokered ADB capability to push an arbitrary APK to the connected headset — is an inference drawn from SideQuest’s documented brokering role and is not described in the available advisory, NVD, or other cited sources [1][2]. It is carried in Section 6 as an explicitly low-evidence modeling path (EV:1), not as a reported fact, and is not asserted here as part of the documented mechanism.

Several details remain undisclosed and matter for a precise understanding: the specific vulnerable source file, function, or code path; the exact malicious payload; and whether execution lands in the Electron renderer or the main process, along with the precise privilege level of the resulting execution. The sources state “remote code execution” without pinning privilege detail — so any characterization of the execution as strictly logged-in-user-level authority is a reasoned assumption rather than a documented fact [1][2].

4. Discovery & timeline

The vulnerability was reported to and credited by SideQuest in its GitHub Security Advisory GHSA-3v86-cf9q-x4x7, with discovery credited to @coolcoolnoworries [1]. The advisory was published on 2024-01-04 and rates the issue HIGH severity, documenting both the root cause and the fix in version 0.10.35 [1]. CISA’s weekly vulnerability summary bulletin SB24-008 subsequently listed CVE-2024-21625 among vulnerabilities disclosed the week of January 1, 2024, carrying the improper-input-validation description and the CVSS 8.8 HIGH rating; this provides a government-index confirmation of disclosure timing and severity [4]. The vendor released the fixed build (0.10.35) as the remediation; the advisory frames the upgrade as the corrective action [1].

5. Technical reference

• CVE: CVE-2024-21625 [2][3]
• CWE: CWE-20 — Improper Input Validation [2]
• CVSS v3.1: 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H [2]
• AV:N / AC:L / PR:N — reachable over the network, low complexity, no privileges needed: the bar to attempt exploitation is low.
• UI:R — user interaction is required: the victim must click the malicious link from within the app; this is the single gating factor and is why it is “one-click” rather than “zero-click.”
• S:U — scope unchanged: per CVSS, impact is scored within the vulnerable component’s own authority, so the base score does not attempt to express any cross-component authority chain.
• C:H / I:H / A:H — full confidentiality, integrity, and availability impact, consistent with arbitrary code execution.
• EPSS: ~0.0085 (roughly 0.85% probability of exploitation in the next 30 days), ~54th percentile, per FIRST.org EPSS [6]. This is a modeled likelihood score, not a severity rating, and it is not part of the cited primary advisories; it is provided here for completeness.
• Code/commit refs: the exact patch commit/diff implementing the sanitization in 0.10.35 is not disclosed in available sources; the CNA is GitHub, and the authoritative advisory is GHSA-3v86-cf9q-x4x7 [1][3].

6. Consequence & CFSE path analysis

Real-world consequence: An internet-reachable, one-click crafted sidequest:// link causes arbitrary code execution inside the SideQuest Electron process. The entry models this at the logged-in PC user’s privilege — bounded user-level authority, not root/admin/signing-root — able to read the PC user’s data and SideQuest credentials/tokens; note that the privilege bound is an assumption, since the sources say only “remote code execution” without privilege detail. A plausible downstream consequence (inferred, not reproduced, and not present in any cited source) is a pivot through SideQuest’s brokered ADB to push a malicious APK onto the connected headset, letting a sideloaded VR app read sensor/camera/spatial/account state and manipulate the immersive display to distort the wearer’s perceived reality. Physical/safety impact is characterized as disorientation from a manipulated immersive environment rather than a credibly documented injury, and it too is an inference rather than a reported effect.

Why the CFSE Path Score differs from CVSS: CVSS collapses this into a single 8.8 HIGH base score anchored on the PC-level RCE, and its unchanged-scope (S:U) base does not attempt to express any cross-component authority chain. The CFSE analysis instead decomposes the sidequest:// deep-link RCE into two risk paths to separate what is directly reported from what is inferred, and to carry the web→desktop→device cross-domain authority chain (CH:4) as a CFSE modeling choice.

Methodology note on the verdict: The two paths below are NOT co-equal in evidentiary weight, and the CRITICAL verdict must not be read as resting on the inferred headset pivot. The directly reported effect — one-click arbitrary code execution on the victim PC at (as modeled) logged-in-user authority — is by itself the verdict-driving path: it is grounded in [1] and [2] and independently supports a CRITICAL band. The PERCEPTION_TO_ACTION headset-pivot path is retained only as an explicitly low-evidence (EV:1) modeling extension; per CFSE banding methodology an EV:1 inference path does not itself lift or set the verdict, and the “UNDER” direction relative to the 8.8 HIGH CVSS baseline is justified by the grounded ACCOUNT_AUTHORITY path alone (network-reachable one-click RCE with full C/I/A) rather than by the inferred pivot. If the pivot were removed entirely, the verdict and direction would be unchanged.

• ACCOUNT_AUTHORITY path (verdict-driving, grounded) (RE:4/EC:4/EX:4/PH:2/DP:3/AT:2/CH:4/SR:4/SX:3/OR:2/EV:2): captures the directly reported effect — an internet-reachable one-click crafted link achieves arbitrary code execution at (as modeled) the logged-in PC user’s privilege inside the SideQuest Electron process, bounded user-level authority rather than root/admin/signing root, able to read PC-user data and SideQuest credentials/tokens. This path is grounded in [1][2] and by itself supports the CRITICAL band.
• PERCEPTION_TO_ACTION path (inferred extension, NOT verdict-driving) (RE:4/EC:3/EX:3/PH:2/DP:4/AT:3/CH:4/SR:4/SX:3/OR:2/EV:1): models the post-RCE pivot in which SideQuest’s brokered ADB pushes an arbitrary APK to a connected headset, letting a malicious sideloaded VR app read sensor/camera/spatial/account state and manipulate the immersive display to control the wearer’s perceived reality. The headset-pivot step is inferred from the brokering capability rather than reproduced or documented in any cited source (EV:1); it is carried for modeling completeness and does not drive the verdict.

Both paths share a web→desktop→device cross-domain authority chain (CH:4), a single mass-distributable payload gated by a per-victim connected-headset click (SR:4/SX:3), and recovery by app update plus removing the pushed app with no key/signing-root rotation (OR:2, patch available). Physical/safety impact is modeled as disorientation from a manipulated immersive environment rather than a credibly documented injury (PH:2), and is itself inferential. Neither path takes a cap or systemic uplift.

Verdict: CRITICAL — direction UNDER relative to the published 8.8 HIGH CVSS baseline. As noted above, the verdict rests on the grounded ACCOUNT_AUTHORITY path; the EV:1 pivot is a non-driving modeling extension.

7. Remediation & mitigations

• Upgrade to SideQuest desktop 0.10.35 or later. This is the vendor fix: in 0.10.35 the custom-protocol (sidequest://) deep-link URLs within the Electron application are parsed and sanitized properly, closing the improper-input-validation path [1][2]. The advisory strongly recommends the upgrade, and because the defect is in the desktop client’s own protocol handling, updating the desktop app is the complete and authoritative remediation.
• Interim exposure reduction (until patched): the exploit requires all three preconditions to co-occur — a vulnerable app running, a headset connected, and the victim clicking a malicious sidequest:// link from within the app. On a host still on a pre-0.10.35 build, not leaving the app open with a headset connected while clicking untrusted in-app links removes the trigger window; disconnecting the headset when not actively sideloading removes the device-connected precondition. This follows directly from the documented trigger conditions [1][2] rather than generic guidance.
• Post-compromise cleanup: recovery is by app update plus removing any pushed or sideloaded app; no key or signing-root rotation is implicated by this bug. On a compromised host, remediation centers on updating SideQuest to 0.10.35+ and auditing/removing unexpected sideloaded APKs on the connected headset. Note that the headset-pivot (an APK push via brokered ADB) is inferred and not present in the cited sources (see Sections 3, 6, and 9); the APK-audit step is therefore precautionary rather than a response to a documented pivot.

8. Sources

[1] One-click remote code execution via malicious deep link (GHSA-3v86-cf9q-x4x7) — SideQuestVR (GitHub Security Advisory) — https://github.com/SideQuestVR/SideQuest/security/advisories/GHSA-3v86-cf9q-x4x7 — Authoritative vendor/researcher advisory establishing root cause, one-click condition, affected/fixed versions, HIGH severity, CWE-20, researcher credit, and publication date. — primary-advisory. [2] NVD — CVE-2024-21625 Detail — NIST National Vulnerability Database — https://nvd.nist.gov/vuln/detail/CVE-2024-21625 — Canonical NVD record: normalized description, CWE-20 mapping, CVSS v3.1 8.8 HIGH vector (the published baseline), affected product/version. — primary-advisory. [3] CVE-2024-21625 CVE Record — CVE.org (GitHub as CNA) — https://www.cve.org/CVERecord?id=CVE-2024-21625 — Official CVE.org record corroborating description, CWE, affected/fixed versions, and authoritative reference set independent of NVD enrichment. — primary-advisory. [4] Vulnerability Summary for the Week of January 1, 2024 (SB24-008) — CISA — https://www.cisa.gov/news-events/bulletins/sb24-008 — Government-index confirmation that CVE-2024-21625 was disclosed that week with the improper-input-validation description and CVSS 8.8 HIGH. — primary-advisory. [5] CVE-2024-21625 — Improper Input Validation vulnerability in Sidequestvr Sidequest — Vumetric Cyber Portal — https://cyber.vumetric.com/vulns/CVE-2024-21625/improper-input-validation-vulnerability-in-sidequestvr-sidequest/ — Independent secondary tracker corroborating CWE-20, the sidequest:// one-click RCE mechanism, affected/fixed versions, and CVSS 8.8 HIGH. — reputable-press. [6] EPSS score for CVE-2024-21625 — FIRST.org EPSS API — https://api.first.org/data/v1/epss?cve=CVE-2024-21625 — Exploit Prediction Scoring System data (EPSS ~0.0085, ~54th percentile); a modeled exploitation-likelihood score, not a severity rating, and not part of the primary advisories. — data-index.