CVE-2017-15427: XSS

Q: What must an attacker do to exploit this issue?

The attacker must socially engineer a user into dragging and dropping a javascript: URL into the browser's URL bar. The issue has network attack vector and requires user interaction; no privileges are required.

Q: Are users affected during ordinary browsing?

The described exploit requires the user to perform the drag-and-drop action into the Omnibox. The provided information does not indicate exploitation through ordinary page viewing alone.

Q: Which versions are affected?

Google Chrome versions prior to 63.0.3239.84 are affected. The listed software also includes Chromium packages for Debian and Red Hat Enterprise Linux systems, but no package-specific fixed versions are provided.

Q: What is the impact if exploitation succeeds?

A successful exploit allows a user to XSS themselves. The supplied severity vector indicates low confidentiality and integrity impact, with no availability impact.

Published Dec 7, 2017

Updated

An insufficient blocking of javascript flaw was found in the Omnibox component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=768910

External References:

https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html

Other sources

Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a socially engineered user to XSS themselves by dragging and dropping a javascript: URL into the URL bar.

Affected Software

7 affected componentsFixes available

debian/chromium-browser

redhat/chromium-browser<63.0.3239.84

63.0.3239.84

Google Chrome<63.0.3239.84

redhat Enterprise Linux Desktop=6.0

redhat Enterprise Linux Server=6.0

redhat Enterprise Linux Workstation=6.0

Debian Debian Linux=9.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/chromium-browser to a version that resolves this vulnerability.
Fixed in 63.0.3239.84
Upgrade
Upgrade Google Chrome to a version that resolves this vulnerability.
Fixed in 63.0.3239.84

Event History

Dec 7, 2017

Data Sourced

via Red Hat·09:55 AM

DescriptionSeverityAffected Software

Aug 28, 2018

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Frequently Asked Questions

What must an attacker do to exploit this issue?

The attacker must socially engineer a user into dragging and dropping a javascript: URL into the browser's URL bar. The issue has network attack vector and requires user interaction; no privileges are required.

Are users affected during ordinary browsing?

The described exploit requires the user to perform the drag-and-drop action into the Omnibox. The provided information does not indicate exploitation through ordinary page viewing alone.

Which versions are affected?

Google Chrome versions prior to 63.0.3239.84 are affected. The listed software also includes Chromium packages for Debian and Red Hat Enterprise Linux systems, but no package-specific fixed versions are provided.

What is the impact if exploitation succeeds?

A successful exploit allows a user to XSS themselves. The supplied severity vector indicates low confidentiality and integrity impact, with no availability impact.

CVE-2017-15427: XSS

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker do to exploit this issue?

Are users affected during ordinary browsing?

Which versions are affected?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

Are users affected during ordinary browsing?

Which versions are affected?

What is the impact if exploitation succeeds?