CVE-2022-26491

What it actually does

DNS spoofing redirects XMPP client connections to a malicious server, causing TLS certificate verification to occur against the attacker-controlled domain rather than the original service domain, enabling full connection takeover for credential and content interception.

Why it matters to the business

Potential exposure of user credentials and all XMPP communication contents could lead to account compromises and leakage of sensitive operational or personal information in environments relying on the affected chat software.

How an attack unfolds

An attacker spoofs DNS responses for the target XMPP domain to redirect the client to a server they control; the client then performs TLS verification on the malicious domain name instead of the original, allowing the attacker to present a valid certificate for their domain, establish the connection, and intercept all traffic including login credentials.

How to fix it

Upgrade Pidgin to version 2.14.9 or later on all affected systems; consider enabling DNSSEC or using pinned server addresses where supported to reduce spoofing risks.

How to confirm the fix worked

Verify installed Pidgin version is 2.14.9 or newer via application about dialog or package manager; test by simulating DNS redirection in a lab environment and confirming certificate verification failures or connection blocks for spoofed domains.

Typical attack path

1. Spoof DNS responses to redirect XMPP domain queries to attacker server
2. Client initiates connection to malicious endpoint
3. TLS certificate verification succeeds against attacker-controlled domain
4. Attacker establishes MITM position over the XMPP session
5. Capture authentication credentials and decrypt all subsequent messages

How to detect it

Examine Pidgin debug logs and system DNS query logs for unexpected server IP addresses or certificate validation events tied to XMPP domains; correlate with network traffic showing connections to non-standard XMPP endpoints.

• pidgin process initiating XMPP connections to non-org domains
• DNS responses returning unexpected IPs for known XMPP hostnames

What your security team should do

• Prioritize immediate upgrade of all Pidgin installations to 2.14.9+
• Review and harden DNS resolution configurations to mitigate spoofing
• Enable detailed connection logging in Pidgin for ongoing monitoring