CVE-2019-11354: The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to…

PriorityP357high7.8CVSS 3.1

AVLACLPRNUIRSUCHIHAH

EXPLOIT

EPSS

23.13%

97.5th percentile

The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices communication.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
ea	origin	—	—

Detection & IOCsextracted from sources · hover to see the quote

urlorigin2://game/launch↗

→Monitor for invocation of the Origin2 URI handler (origin2://) with a 'title' parameter containing AngularJS template injection payloads (e.g., {{ }}) which can be used to escape the AngularJS sandbox and achieve RCE. ↗
→Alert on QDesktopServices handling of origin2:// URIs in EA Origin 10.5.36 on Windows, particularly where the title parameter contains template expression syntax. ↗

·The vulnerability is specific to EA Origin version 10.5.36 on Windows; other versions or platforms are not confirmed affected by this CVE. ↗

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.