🕵️ RESEARCH & DEEP DIVES
- RCE and weak crypto found in Internxt's 'post-quantum' encrypted cloud storage
A researcher disclosed that clicking a link can trigger remote code execution in Internxt's desktop app and that its cryptographic architecture is fundamentally weak despite post-quantum claims.- Applies to users of Internxt Drive, an open-source zero-knowledge cloud storage provider claiming post-quantum encryption, over one million active users, and Securitum audits.
- Clicking a malicious link can trigger remote code execution via the internxt:// protocol handler, which calls shell.openExternal without verification, or leak the long-term encryption key to an attacker-chosen URL.
- Desktop releases up to 2.6.12 remain vulnerable to RCE three months after responsible disclosure, despite a fix merged into the main branch; a patched v2.7 was promised.
- Public keys are never verified (no fingerprinting or pinning), folder sharing hands over the never-changing mnemonic that derives all file keys, and the server can intercept it in all three sharing flows.
- Passwords are protected with a KDF using just 3 iterations of MD5, and file keys are used with AES-256-CTR without enforced integrity protection.