XSS in Trezor Connect legacy versions

[mroz22]

Impact: Possible phishing attack
Scalability: Remote (Interaction)
Severity: Medium
Reported by: Jun Kokatsu
Date reported: 2023-02-07

Details

We were notified by Jun Kokatsu that there were XSS vulnerabilities, similar to those reported in August 2020 (see #46). These vulnerabilities were present in the deprecated versions of Trezor Connect that were however still available to legacy implementations on urls https://trezor.connect.io/5, https://trezor.connect.io/6 and https://trezor.connect.io/7.

We are not aware of any abuse and users funds were safe. This issue posed a potential threat of a phishing attack which could gain more trust by changing content served from the trezor.io domain.

Fix

The issue was fixed by removing those affected versions completely.