Vulnerabilities > CVE-2018-6145 - Cross-site Scripting vulnerability in Google Chrome
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
LOW Integrity impact
LOW Availability impact
NONE Summary
Insufficient data validation in HTML parser in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Cross Site Scripting through Log Files An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
- Embedding Scripts in Non-Script Elements This attack is a form of Cross-Site Scripting (XSS) where malicious scripts are embedded in elements that are not expected to host scripts such as image tags (<img>), comments in XML documents (< !-CDATA->), etc. These tags may not be subject to the same input validation, output validation, and other content filtering and checking routines, so this can create an opportunity for an attacker to tunnel through the application's elements and launch a XSS attack through other elements. As with all remote attacks, it is important to differentiate the ability to launch an attack (such as probing an internal network for unpatched servers) and the ability of the remote attacker to collect and interpret the output of said attack.
- Embedding Scripts within Scripts An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts. The attacker leverages this capability to execute scripts to execute his/her own script by embedding it within other scripts that the target software is likely to execute. The attacker must have the ability to inject script into script that is likely to be executed. If this is done, then the attacker can potentially launch a variety of probes and attacks against the web server's local environment, in many cases the so-called DMZ, back end resources the web server can communicate with, and other hosts. With the proliferation of intermediaries, such as Web App Firewalls, network devices, and even printers having JVMs and Web servers, there are many locales where an attacker can inject malicious scripts. Since this attack pattern defines scripts within scripts, there are likely privileges to execute said attack on the host. Of course, these attacks are not solely limited to the server side, client side scripts like Ajax and client side JavaScript can contain malicious scripts as well. In general all that is required is for there to be sufficient privileges to execute a script, but not protected against writing.
- Cross-Site Scripting in Error Pages An attacker distributes a link (or possibly some other query structure) with a request to a third party web server that is malformed and also contains a block of exploit code in order to have the exploit become live code in the resulting error page. When the third party web server receives the crafted request and notes the error it then creates an error message that echoes the malformed message, including the exploit. Doing this converts the exploit portion of the message into to valid language elements that are executed by the viewing browser. When a victim executes the query provided by the attacker the infected error message error message is returned including the exploit code which then runs in the victim's browser. XSS can result in execution of code as well as data leakage (e.g. session cookies can be sent to the attacker). This type of attack is especially dangerous since the exploit appears to come from the third party web server, who the victim may trust and hence be more vulnerable to deception.
- Cross-Site Scripting Using Alternate Syntax The attacker uses alternate forms of keywords or commands that result in the same action as the primary form but which may not be caught by filters. For example, many keywords are processed in a case insensitive manner. If the site's web filtering algorithm does not convert all tags into a consistent case before the comparison with forbidden keywords it is possible to bypass filters (e.g., incomplete black lists) by using an alternate case structure. For example, the "script" tag using the alternate forms of "Script" or "ScRiPt" may bypass filters where "script" is the only form tested. Other variants using different syntax representations are also possible as well as using pollution meta-characters or entities that are eventually ignored by the rendering engine. The attack can result in the execution of otherwise prohibited functionality.
Nessus
NASL family SuSE Local Security Checks NASL id OPENSUSE-2018-546.NASL description This update for chromium to version 66.0.3359.181 fixes the following issues : The following security issues were fixed (boo#1095163) : - CVE-2018-6123: Use after free in Blink. - CVE-2018-6124: Type confusion in Blink. - CVE-2018-6125: Overly permissive policy in WebUSB. - CVE-2018-6126: Heap buffer overflow in Skia. - CVE-2018-6127: Use after free in indexedDB. - CVE-2018-6128: uXSS in Chrome on iOS. - CVE-2018-6129: Out of bounds memory access in WebRTC. - CVE-2018-6130: Out of bounds memory access in WebRTC. - CVE-2018-6131: Incorrect mutability protection in WebAssembly. - CVE-2018-6132: Use of uninitialized memory in WebRTC. - CVE-2018-6133: URL spoof in Omnibox. - CVE-2018-6134: Referrer Policy bypass in Blink. - CVE-2018-6135: UI spoofing in Blink. - CVE-2018-6136: Out of bounds memory access in V8. - CVE-2018-6137: Leak of visited status of page in Blink. - CVE-2018-6138: Overly permissive policy in Extensions. - CVE-2018-6139: Restrictions bypass in the debugger extension API. - CVE-2018-6140: Restrictions bypass in the debugger extension API. - CVE-2018-6141: Heap buffer overflow in Skia. - CVE-2018-6142: Out of bounds memory access in V8. - CVE-2018-6143: Out of bounds memory access in V8. - CVE-2018-6144: Out of bounds memory access in PDFium. - CVE-2018-6145: Incorrect escaping of MathML in Blink. - CVE-2018-6147: Password fields not taking advantage of OS protections in Views. Additional changes : - Autoplay: Force enable on desktop for Web Audio This update enables the last seen 2020-06-05 modified 2018-06-01 plugin id 110275 published 2018-06-01 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/110275 title openSUSE Security Update : chromium (openSUSE-2018-546) NASL family SuSE Local Security Checks NASL id OPENSUSE-2018-759.NASL description This update for Chromium to version 67.0.3396.99 fixes multiple issues. Security issues fixed (bsc#1095163) : - CVE-2018-6123: Use after free in Blink - CVE-2018-6124: Type confusion in Blink - CVE-2018-6125: Overly permissive policy in WebUSB - CVE-2018-6126: Heap buffer overflow in Skia - CVE-2018-6127: Use after free in indexedDB - CVE-2018-6129: Out of bounds memory access in WebRTC - CVE-2018-6130: Out of bounds memory access in WebRTC - CVE-2018-6131: Incorrect mutability protection in WebAssembly - CVE-2018-6132: Use of uninitialized memory in WebRTC - CVE-2018-6133: URL spoof in Omnibox - CVE-2018-6134: Referrer Policy bypass in Blink - CVE-2018-6135: UI spoofing in Blink - CVE-2018-6136: Out of bounds memory access in V8 - CVE-2018-6137: Leak of visited status of page in Blink - CVE-2018-6138: Overly permissive policy in Extensions - CVE-2018-6139: Restrictions bypass in the debugger extension API - CVE-2018-6140: Restrictions bypass in the debugger extension API - CVE-2018-6141: Heap buffer overflow in Skia - CVE-2018-6142: Out of bounds memory access in V8 - CVE-2018-6143: Out of bounds memory access in V8 - CVE-2018-6144: Out of bounds memory access in PDFium - CVE-2018-6145: Incorrect escaping of MathML in Blink - CVE-2018-6147: Password fields not taking advantage of OS protections in Views - CVE-2018-6148: Incorrect handling of CSP header (boo#1096508) - CVE-2018-6149: Out of bounds write in V8 (boo#1097452) The following tracked packaging changes are included : - Require ffmpeg >= 4.0 (boo#1095545) last seen 2020-06-05 modified 2018-07-26 plugin id 111345 published 2018-07-26 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/111345 title openSUSE Security Update : Chromium (openSUSE-2018-759) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-4237.NASL description Several vulnerabilities have been discovered in the chromium web browser. - CVE-2018-6118 Ned Williamson discovered a use-after-free issue. - CVE-2018-6120 Zhou Aiting discovered a buffer overflow issue in the pdfium library. - CVE-2018-6121 It was discovered that malicious extensions could escalate privileges. - CVE-2018-6122 A type confusion issue was discovered in the v8 JavaScript library. - CVE-2018-6123 Looben Yang discovered a use-after-free issue. - CVE-2018-6124 Guang Gong discovered a type confusion issue. - CVE-2018-6125 Yubico discovered that the WebUSB implementation was too permissive. - CVE-2018-6126 Ivan Fratric discovered a buffer overflow issue in the skia library. - CVE-2018-6127 Looben Yang discovered a use-after-free issue. - CVE-2018-6129 Natalie Silvanovich discovered an out-of-bounds read issue in WebRTC. - CVE-2018-6130 Natalie Silvanovich discovered an out-of-bounds read issue in WebRTC. - CVE-2018-6131 Natalie Silvanovich discovered an error in WebAssembly. - CVE-2018-6132 Ronald E. Crane discovered an uninitialized memory issue. - CVE-2018-6133 Khalil Zhani discovered a URL spoofing issue. - CVE-2018-6134 Jun Kokatsu discovered a way to bypass the Referrer Policy. - CVE-2018-6135 Jasper Rebane discovered a user interface spoofing issue. - CVE-2018-6136 Peter Wong discovered an out-of-bounds read issue in the v8 JavaScript library. - CVE-2018-6137 Michael Smith discovered an information leak. - CVE-2018-6138 Francois Lajeunesse-Robert discovered that the extensions policy was too permissive. - CVE-2018-6139 Rob Wu discovered a way to bypass restrictions in the debugger extension. - CVE-2018-6140 Rob Wu discovered a way to bypass restrictions in the debugger extension. - CVE-2018-6141 Yangkang discovered a buffer overflow issue in the skia library. - CVE-2018-6142 Choongwoo Han discovered an out-of-bounds read in the v8 JavaScript library. - CVE-2018-6143 Guang Gong discovered an out-of-bounds read in the v8 JavaScript library. - CVE-2018-6144 pdknsk discovered an out-of-bounds read in the pdfium library. - CVE-2018-6145 Masato Kinugawa discovered an error in the MathML implementation. - CVE-2018-6147 Michail Pishchagin discovered an error in password entry fields. - CVE-2018-6148 Michal Bentkowski discovered that the Content Security Policy header was handled incorrectly. - CVE-2018-6149 Yu Zhou and Jundong Xie discovered an out-of-bounds write issue in the v8 JavaScript library. last seen 2020-06-01 modified 2020-06-02 plugin id 110820 published 2018-07-02 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/110820 title Debian DSA-4237-1 : chromium-browser - security update NASL family Fedora Local Security Checks NASL id FEDORA_2018-09B59B0227.NASL description Update to Chromium 67. Security fix for CVE-2018-6123 CVE-2018-6124 CVE-2018-6125 CVE-2018-6126 CVE-2018-6127 CVE-2018-6128 CVE-2018-6129 CVE-2018-6130 CVE-2018-6131 CVE-2018-6132 CVE-2018-6133 CVE-2018-6134 CVE-2018-6135 CVE-2018-6136 CVE-2018-6137 CVE-2018-6148 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2018-06-21 plugin id 110625 published 2018-06-21 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/110625 title Fedora 27 : chromium (2018-09b59b0227) NASL family Fedora Local Security Checks NASL id FEDORA_2018-7C80AAEF26.NASL description Update to Chromium 67. Security fix for CVE-2018-6123 CVE-2018-6124 CVE-2018-6125 CVE-2018-6126 CVE-2018-6127 CVE-2018-6128 CVE-2018-6129 CVE-2018-6130 CVE-2018-6131 CVE-2018-6132 CVE-2018-6133 CVE-2018-6134 CVE-2018-6135 CVE-2018-6136 CVE-2018-6137 CVE-2018-6148 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2019-01-03 plugin id 120558 published 2019-01-03 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/120558 title Fedora 28 : chromium (2018-7c80aaef26) NASL family SuSE Local Security Checks NASL id OPENSUSE-2019-548.NASL description This update for Chromium to version 67.0.3396.99 fixes multiple issues. Security issues fixed (bsc#1095163) : - CVE-2018-6123: Use after free in Blink - CVE-2018-6124: Type confusion in Blink - CVE-2018-6125: Overly permissive policy in WebUSB - CVE-2018-6126: Heap buffer overflow in Skia - CVE-2018-6127: Use after free in indexedDB - CVE-2018-6129: Out of bounds memory access in WebRTC - CVE-2018-6130: Out of bounds memory access in WebRTC - CVE-2018-6131: Incorrect mutability protection in WebAssembly - CVE-2018-6132: Use of uninitialized memory in WebRTC - CVE-2018-6133: URL spoof in Omnibox - CVE-2018-6134: Referrer Policy bypass in Blink - CVE-2018-6135: UI spoofing in Blink - CVE-2018-6136: Out of bounds memory access in V8 - CVE-2018-6137: Leak of visited status of page in Blink - CVE-2018-6138: Overly permissive policy in Extensions - CVE-2018-6139: Restrictions bypass in the debugger extension API - CVE-2018-6140: Restrictions bypass in the debugger extension API - CVE-2018-6141: Heap buffer overflow in Skia - CVE-2018-6142: Out of bounds memory access in V8 - CVE-2018-6143: Out of bounds memory access in V8 - CVE-2018-6144: Out of bounds memory access in PDFium - CVE-2018-6145: Incorrect escaping of MathML in Blink - CVE-2018-6147: Password fields not taking advantage of OS protections in Views - CVE-2018-6148: Incorrect handling of CSP header (boo#1096508) - CVE-2018-6149: Out of bounds write in V8 (boo#1097452) The following tracked packaging changes are included : - Require ffmpeg >= 4.0 (boo#1095545) last seen 2020-05-31 modified 2019-03-27 plugin id 123234 published 2019-03-27 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/123234 title openSUSE Security Update : Chromium (openSUSE-2019-548) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_427B0F58644C11E89E1BE8E0B747A45A.NASL description Google Chrome Releases reports : 34 security fixes in this release, including : - [835639] High CVE-2018-6123: Use after free in Blink. Reported by Looben Yang on 2018-04-22 - [840320] High CVE-2018-6124: Type confusion in Blink. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-07 - [818592] High CVE-2018-6125: Overly permissive policy in WebUSB. Reported by Yubico, Inc on 2018-03-05 - [844457] High CVE-2018-6126: Heap buffer overflow in Skia. Reported by Ivan Fratric of Google Project Zero on 2018-05-18 - [842990] High CVE-2018-6127: Use after free in indexedDB. Reported by Looben Yang on 2018-05-15 - [841105] High CVE-2018-6128: uXSS in Chrome on iOS. Reported by Tomasz Bojarski on 2018-05-09 - [838672] High CVE-2018-6129: Out of bounds memory access in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-05-01 - [838402] High CVE-2018-6130: Out of bounds memory access in WebRTC. Reported by Natalie Silvanovich of Google Project Zero on 2018-04-30 - [826434] High CVE-2018-6131: Incorrect mutability protection in WebAssembly. Reported by Natalie Silvanovich of Google Project Zero on 2018-03-27 - [839960] Medium CVE-2018-6132: Use of uninitialized memory in WebRTC. Reported by Ronald E. Crane on 2018-05-04 - [817247] Medium CVE-2018-6133: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-28 - [797465] Medium CVE-2018-6134: Referrer Policy bypass in Blink. Reported by Jun Kokatsu (@shhnjk) on 2017-12-23 - [823353] Medium CVE-2018-6135: UI spoofing in Blink. Reported by Jasper Rebane on 2018-03-19 - [831943] Medium CVE-2018-6136: Out of bounds memory access in V8. Reported by Peter Wong on 2018-04-12 - [835589] Medium CVE-2018-6137: Leak of visited status of page in Blink. Reported by Michael Smith (spinda.net) on 2018-04-21 - [810220] Medium CVE-2018-6138: Overly permissive policy in Extensions. Reported by Francois Lajeunesse-Robert on 2018-02-08 - [805224] Medium CVE-2018-6139: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-24 - [798222] Medium CVE-2018-6140: Restrictions bypass in the debugger extension API. Reported by Rob Wu on 2018-01-01 - [796107] Medium CVE-2018-6141: Heap buffer overflow in Skia. Reported by Yangkang (@dnpushme) and Wanglu of Qihoo360 Qex Team on 2017-12-19 - [837939] Medium CVE-2018-6142: Out of bounds memory access in V8. Reported by Choongwoo Han of Naver Corporation on 2018-04-28 - [843022] Medium CVE-2018-6143: Out of bounds memory access in V8. Reported by Guang Gong of Alpha Team, Qihoo 360 on 2018-05-15 - [828049] Low CVE-2018-6144: Out of bounds memory access in PDFium. Reported by pdknsk on 2018-04-02 - [805924] Low CVE-2018-6145: Incorrect escaping of MathML in Blink. Reported by Masato Kinugawa on 2018-01-25 - [818133] Low CVE-2018-6147: Password fields not taking advantage of OS protections in Views. Reported by Michail Pishchagin (Yandex) on 2018-03-02 - [847542] Various fixes from internal audits, fuzzing and other initiatives last seen 2020-06-01 modified 2020-06-02 plugin id 110254 published 2018-05-31 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/110254 title FreeBSD : chromium -- multiple vulnerabilities (427b0f58-644c-11e8-9e1b-e8e0b747a45a) NASL family Windows NASL id GOOGLE_CHROME_67_0_3396_62.NASL description The version of Google Chrome installed on the remote Windows host is prior to 67.0.3396.62. It is, therefore, affected by a multiple unspecified vulnerabilities as noted in Chrome stable channel update release notes for May 29th, 2018. Please refer to the release notes for additional information. Note that Nessus has not attempted to exploit these issues but has instead relied only on the application last seen 2020-06-01 modified 2020-06-02 plugin id 110228 published 2018-05-31 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/110228 title Google Chrome < 67.0.3396.62 Multiple Vulnerabilities NASL family MacOS X Local Security Checks NASL id MACOSX_GOOGLE_CHROME_67_0_3396_62.NASL description The version of Google Chrome installed on the remote host is prior to 67.0.3396.62. It is, therefore, affected by multiple unspecified vulnerabilities as noted in Chrome stable channel update release notes for May 29th, 2018. Please refer to the release notes for additional information. Note that Nessus has not attempted to exploit these issues but has instead relied only on the application last seen 2020-06-01 modified 2020-06-02 plugin id 110229 published 2018-05-31 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/110229 title Google Chrome < 67.0.3396.62 Multiple Vulnerabilities (macOS) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2018-1815.NASL description An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Chromium is an open source web browser, powered by WebKit (Blink). This update upgrades Chromium to version 67.0.3396.62. Security Fix(es) : * chromium-browser: Use after free in Blink (CVE-2018-6123) * chromium-browser: Type confusion in Blink (CVE-2018-6124) * chromium-browser: Overly permissive policy in WebUSB (CVE-2018-6125) * chromium-browser: Heap buffer overflow in Skia (CVE-2018-6126) * chromium-browser: Use after free in indexedDB (CVE-2018-6127) * chromium-browser: Out of bounds memory access in WebRTC (CVE-2018-6129) * chromium-browser: Out of bounds memory access in WebRTC (CVE-2018-6130) * chromium-browser: Incorrect mutability protection in WebAssembly (CVE-2018-6131) * chromium-browser: Use of uninitialized memory in WebRTC (CVE-2018-6132) * chromium-browser: URL spoof in Omnibox (CVE-2018-6133) * chromium-browser: Referrer Policy bypass in Blink (CVE-2018-6134) * chromium-browser: UI spoofing in Blink (CVE-2018-6135) * chromium-browser: Out of bounds memory access in V8 (CVE-2018-6136) * chromium-browser: Leak of visited status of page in Blink (CVE-2018-6137) * chromium-browser: Overly permissive policy in Extensions (CVE-2018-6138) * chromium-browser: Restrictions bypass in the debugger extension API (CVE-2018-6139) * chromium-browser: Restrictions bypass in the debugger extension API (CVE-2018-6140) * chromium-browser: Heap buffer overflow in Skia (CVE-2018-6141) * chromium-browser: Out of bounds memory access in V8 (CVE-2018-6142) * chromium-browser: Out of bounds memory access in V8 (CVE-2018-6143) * chromium-browser: Out of bounds memory access in PDFium (CVE-2018-6144) * chromium-browser: Incorrect escaping of MathML in Blink (CVE-2018-6145) * chromium-browser: Password fields not taking advantage of OS protections in Views (CVE-2018-6147) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. last seen 2020-05-31 modified 2018-06-08 plugin id 110406 published 2018-06-08 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/110406 title RHEL 6 : chromium-browser (RHSA-2018:1815)
Redhat
| rpms |
|