CVE-2014-3160 in Chrome
Summary
by MITRE
The ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp in Blink, as used in Google Chrome before 36.0.1985.125, does not properly restrict subresource requests associated with SVG files, which allows remote attackers to bypass the Same Origin Policy via a crafted file.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 02/09/2022
The vulnerability identified as CVE-2014-3160 resides within the Blink rendering engine component of Google Chrome, specifically in the ResourceFetcher::canRequest function located in core/fetch/ResourceFetcher.cpp. This flaw represents a critical security weakness that undermines the fundamental Same Origin Policy (SOP) mechanisms designed to prevent unauthorized cross-origin resource access. The vulnerability affects Chrome versions prior to 36.0.1985.125, making it a significant concern for users running outdated browser versions. The issue manifests when processing subresource requests associated with Scalable Vector Graphics files, which are commonly used for web graphics and animations.
The technical implementation flaw stems from improper validation within the ResourceFetcher::canRequest function that fails to adequately restrict how subresources are requested when dealing with SVG files. This weakness allows malicious actors to craft specially formatted SVG files that can bypass the browser's security controls designed to prevent cross-origin requests. The vulnerability specifically exploits the way Blink handles resource fetching for SVG content, creating a pathway where external resources can be loaded without proper origin verification. This bypass mechanism operates through the manipulation of how SVG files reference external resources, effectively circumventing the browser's security boundaries that normally prevent such unauthorized access.
The operational impact of this vulnerability is substantial as it enables remote attackers to perform cross-origin resource loading attacks that could potentially lead to information disclosure, data exfiltration, or further exploitation. Attackers can craft malicious SVG files that, when loaded by a victim's browser, can request resources from other origins that would normally be restricted. This capability could be leveraged to access sensitive data from different domains, perform cross-site request forgery attacks, or gather information about the victim's browsing environment. The vulnerability particularly affects web applications that process user-uploaded SVG content or display third-party SVG graphics, creating attack vectors through seemingly benign file uploads or embedded content.
This vulnerability maps to CWE-284, which describes improper access control mechanisms, and aligns with several ATT&CK techniques including T1059 for command and scripting interpreter and T1071 for application layer protocol. The attack surface is particularly concerning given that SVG files are commonly used in web applications and can be embedded directly into web pages without additional security considerations. Organizations and users should prioritize immediate patching of affected Chrome versions to mitigate this risk. The remediation involves updating to Chrome version 36.0.1985.125 or later, where the ResourceFetcher::canRequest function has been properly modified to enforce stricter validation of subresource requests. Additionally, administrators should implement content security policies and sanitize all user-uploaded SVG files to prevent exploitation of this vulnerability in environments where immediate patching may not be feasible.