Arbitrary URI Scheme Execution in Magic: The Gathering Arena

Executive Summary

This vulnerability in Magic: The Gathering Arena (MTGA) Windows client allows a server-controlled URL to be passed directly to the Windows shell via ShellExecuteW without validating the URI scheme or domain. This means an attacker controlling the carousel content could trick the client into launching arbitrary URI-scheme handlers on the victim's system without user interaction.

Useful 0 Not Useful 0

Detection Guidance

Check if Magic: The Gathering Arena processes server-supplied URLs without validating URI schemes. Monitor network traffic for unexpected URI scheme handlers being invoked. Test by triggering a benign URI like ms-calculator: to see if it launches automatically.

• Inspect MTGA client logs for ShellExecuteW calls with non-https/http URIs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to silently launch applications or execute code on your system if a vulnerable URI handler (like ms-msdt for Follina) is registered. For example, a malicious ms-calculator: URI could automatically open Windows Calculator without your consent.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves client-side URI handling in a gaming application rather than data processing or privacy controls. However, if malicious URI handlers were exploited, it could potentially lead to unauthorized system access or data exfiltration, indirectly impacting compliance if sensitive data were involved.

Useful 0 Not Useful 0

Mitigation Strategies

Disable or uninstall Magic: The Gathering Arena until a patch is available. Block suspicious URI schemes at the firewall or endpoint level. Avoid clicking carousel links in the application.

• Contact Wizards of the Coast for an official patch or workaround.

Useful 0 Not Useful 0