CVE-2011-4691 in Chrome
Summary
by MITRE
Google Chrome 15.0.874.121 and earlier does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, which makes it easier for remote attackers to determine whether a document exists in the browser cache via crafted JavaScript code.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/16/2017
This vulnerability in Google Chrome versions 15.0.874.121 and earlier represents a significant information disclosure flaw that exploits the browser's handling of Same Origin Policy violations during iframe loading operations. The issue stems from Chrome's failure to properly mask timing information related to cross-origin security checks, creating a side-channel attack vector that can be leveraged by remote adversaries. The vulnerability specifically affects the browser's cache timing mechanisms, allowing attackers to infer cache state information through carefully crafted javascript code that monitors the timing of Same Origin Policy violations.
The technical flaw manifests when Chrome processes iframe elements that attempt to load content from different origins, causing the browser to generate timing data about these violations. This timing information includes the duration between when a violation occurs and when the browser processes the subsequent operations, which can be measured by javascript code running in the context of the same origin page. Attackers can exploit this by creating multiple iframe elements with different target origins and measuring the response times to determine whether specific resources exist in the browser's cache, effectively enabling cache-based fingerprinting attacks.
The operational impact of this vulnerability extends beyond simple information disclosure, as it provides attackers with a method to perform cache poisoning attacks and bypass certain security mechanisms. By determining which documents are cached, adversaries can craft more sophisticated attacks that target specific cache states, potentially leading to session hijacking or other advanced exploitation techniques. This vulnerability particularly affects web applications that rely on cache-based security assumptions or implement custom caching strategies that depend on the browser's cache behavior.
This vulnerability maps to CWE-200 (Information Exposure) and aligns with ATT&CK technique T1082 (System Information Discovery) and T1566 (Phishing with Social Engineering). The attack vector specifically relates to timing-based side-channel information leakage, which is categorized under information exposure vulnerabilities. The vulnerability demonstrates how browser security mechanisms can inadvertently leak information through timing variations, creating a pathway for attackers to gather intelligence about the victim's browser state and cached resources.
Mitigation strategies for this vulnerability involve implementing proper timing obfuscation in browser implementations to ensure that Same Origin Policy violation timing information cannot be reliably captured by javascript code. Browser vendors should modify their security models to prevent timing variations between different types of cross-origin operations, ensuring that all cross-origin checks occur with consistent timing regardless of cache state. Additionally, developers should implement defensive measures such as rate limiting and request randomization to prevent attackers from effectively measuring timing differences. The fix typically involves updating Chrome to version 15.0.874.122 or later, where the timing information leakage has been addressed through modifications to the browser's security model and the implementation of consistent timing mechanisms for cross-origin operations.