CVE-2007-6640 in Creammonkey
Summary
by MITRE
Creammonkey 0.9 through 1.1 and GreaseKit 1.2 through 1.3 does not properly prevent access to dangerous functions, which allows remote attackers to read the configuration, modify the configuration, or send an HTTP request via the (1) GM_addStyle, (2) GM_log, (3) GM_openInTab, (4) GM_setValue, (5) GM_getValue, or (6) GM_xmlhttpRequest function within a web page on which a userscript is configured.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2018
The vulnerability identified as CVE-2007-6640 represents a critical security flaw in browser extension frameworks that enable userscripts to execute within web browsers. Creammonkey versions 0.9 through 1.1 and GreaseKit versions 1.2 through 1.3 suffer from insufficient access controls that fail to properly sandbox dangerous JavaScript functions. This vulnerability stems from the improper implementation of security boundaries within the userscript execution environment, allowing malicious actors to exploit functions that should remain restricted to prevent unauthorized system access. The flaw specifically affects six core functions within the userscript API that provide direct access to system resources and network capabilities. The vulnerability aligns with CWE-284 Access Control Issues, where improper access controls allow unauthorized access to system resources, and represents a classic example of privilege escalation through inadequate function isolation.
The technical implementation of this vulnerability occurs through the exposure of six specific functions that bypass normal security restrictions. GM_addStyle allows manipulation of CSS styling but can be exploited to create malicious visual overlays or hide content. GM_log provides access to logging capabilities that can be abused for information disclosure. GM_openInTab enables opening new browser tabs but can be weaponized to redirect users to malicious sites. GM_setValue and GM_getValue functions provide persistent storage access that can be exploited for configuration manipulation or data exfiltration. GM_xmlhttpRequest permits making HTTP requests but lacks proper origin validation, allowing attackers to send requests to internal systems or perform cross-site request forgery attacks. These functions collectively create a pathway for attackers to perform unauthorized operations that should remain restricted to legitimate userscripts.
The operational impact of this vulnerability extends beyond simple information disclosure to encompass full system compromise potential. Remote attackers can leverage these functions to read sensitive configuration data that may contain authentication credentials, system settings, or user preferences. Configuration modification capabilities allow attackers to alter extension behavior, potentially enabling persistent access or disabling security features. The HTTP request functionality creates opportunities for attackers to perform internal network reconnaissance, access restricted resources, or participate in cross-site scripting attacks against other systems. This vulnerability can be exploited through malicious web pages that load compromised userscripts, making it particularly dangerous as it requires no user interaction beyond visiting a compromised site. The threat model aligns with ATT&CK technique T1059 Command and Scripting Interpreter, where adversaries use legitimate system tools to execute malicious code, and T1566 Phishing, where attackers deliver malicious content through compromised websites.
Mitigation strategies for CVE-2007-6640 require immediate patching of affected versions and implementation of proper access control measures. Users should upgrade to versions that properly sandbox dangerous functions and implement origin validation for all API calls. The recommended approach involves implementing strict function whitelisting where only trusted functions are available to userscripts, combined with proper input validation and origin checking for network operations. Network administrators should monitor for unusual HTTP traffic patterns that might indicate exploitation attempts, particularly requests to internal systems or unusual user agent strings. Extension developers should adopt secure coding practices that include proper function parameter validation, implement proper access control lists for API functions, and ensure that all network operations include proper authentication and authorization checks. The vulnerability demonstrates the critical importance of proper sandboxing in browser extension frameworks and the necessity of implementing defense-in-depth strategies that protect against both direct and indirect exploitation pathways.