Description

Improper neutralization of input in the sessions grid in Progress Telerik Fiddler Everywhere 8.3.0 and earlier allows an attacker to execute backend IPC commands by convincing a user to open a specially crafted SAZ file.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-11-06T17:17:11.210Z",
  "pubdate": "2026-11-06T17:17:11.210Z",
  "executiveSummary": "Progress Telerik Fiddler Everywhere 8.3.0 and earlier are affected by an improper input neutralization vulnerability within the sessions grid component.\nThis vulnerability allows a remote attacker to execute arbitrary backend Inter-Process Communication (IPC) commands on the host machine.\nThe vulnerability is triggered when a user opens a specially crafted Session Archive Zip (SAZ) file within the application.\nSuccessful exploitation results in arbitrary code execution or unauthorized system interactions, depending on the context of the IPC commands accessible via the application interface.\nThis flaw represents a significant security risk, as it weaponizes a standard file format to compromise the integrity of the user's local environment without requiring direct network-level access to the application's API.\nExploitation requires social engineering to persuade a user to load the malicious SAZ file.",
  "technicalDetails": "The vulnerability originates from the insecure handling of data processed by the Fiddler Everywhere sessions grid when importing or opening SAZ files. The sessions grid component fails to properly sanitize or validate the metadata and payload attributes contained within the SAZ file structure before processing them in the application's backend context.\nIn the context of Fiddler Everywhere, the application architecture utilizes IPC mechanisms to communicate between the UI layer (typically a Chromium-based shell) and the backend processes responsible for traffic inspection and session management.\nBy embedding malicious, specially crafted commands within the SAZ file, an attacker can manipulate the input handled by the grid's parsing logic. When the application interprets the malformed data, it inadvertently treats the injected strings as legitimate instructions directed at the backend IPC handlers.\nThe attack flow proceeds as follows: First, the attacker constructs a malicious SAZ file containing serialized data that targets specific IPC command entry points. Second, the attacker distributes this file to a target, leveraging social engineering. Third, when the victim imports or opens the file in Fiddler Everywhere, the sessions grid's vulnerable parser extracts the payload. Finally, the application, failing to enforce strict input neutralization, passes this payload to the IPC layer, where the commands are executed with the privileges of the Fiddler Everywhere process.\nThis vulnerability effectively bypasses the application's intended operational boundaries, allowing the execution of commands that the UI is not designed to expose to end-user input. Because Fiddler Everywhere functions as a web debugging proxy, the backend processes often operate with significant system-level access, meaning successful exploitation can lead to a full compromise of the user's workstation. No specific authentication is required from the attacker to initiate this attack, provided they can successfully deliver and facilitate the opening of the malicious file by an authenticated user of the application."
}