CVE-2015-1229 in Chrome
Summary
by MITRE
net/http/proxy_client_socket.cc in Google Chrome before 41.0.2272.76 does not properly handle a 407 (aka Proxy Authentication Required) HTTP status code accompanied by a Set-Cookie header, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/12/2022
The vulnerability identified as CVE-2015-1229 resides within the proxy handling mechanism of Google Chrome browser versions prior to 41.0.2272.76. This flaw specifically affects the net/http/proxy_client_socket.cc component which manages communication between the browser and proxy servers. The issue manifests when a remote proxy server responds with a 407 status code indicating proxy authentication is required, while simultaneously including a Set-Cookie header in the same response. This particular combination creates an exploitable condition that enables malicious proxy servers to inject arbitrary cookies into the victim's browser session.
The technical exploitation occurs through improper handling of HTTP response parsing where Chrome fails to properly validate the relationship between proxy authentication status codes and cookie headers. When a proxy server returns a 407 response with a Set-Cookie header, the browser's proxy client socket implementation does not adequately separate the authentication challenge from the cookie setting mechanism. This parsing failure allows an attacker-controlled proxy server to inject malicious cookies that would normally be restricted by standard browser security policies, effectively bypassing cookie security boundaries.
From an operational perspective, this vulnerability enables sophisticated cookie-injection attacks that can compromise user sessions and potentially lead to account takeover scenarios. Attackers can leverage this weakness by positioning themselves as malicious proxy servers within a victim's network traffic path. The injected cookies can contain session identifiers, authentication tokens, or other sensitive data that allows attackers to impersonate legitimate users. This vulnerability particularly affects users who rely on proxy servers for network access, including corporate environments where proxy authentication is common.
The security implications extend beyond simple cookie injection to encompass broader session management vulnerabilities. According to CWE classification, this represents a weakness in the validation of HTTP response handling, specifically CWE-20: Improper Input Validation. The vulnerability aligns with ATT&CK technique T1566.002: Phishing via Service Provider, as it can be exploited through compromised proxy servers to deliver malicious cookies. Organizations should consider implementing network monitoring to detect unusual proxy responses containing Set-Cookie headers in 407 status code scenarios. The fix implemented in Chrome 41.0.2272.76 involved strengthening the validation logic to ensure that Set-Cookie headers are properly handled only in appropriate authentication contexts, preventing unauthorized cookie injection during proxy authentication challenges.
Mitigation strategies should focus on immediate browser updates to the patched version, alongside network-level monitoring for anomalous proxy responses. Organizations should also consider implementing additional security controls such as strict proxy server authentication mechanisms and regular security assessments of network infrastructure components that handle HTTP proxy traffic. The vulnerability demonstrates the importance of proper HTTP response parsing and validation in web browser security implementations, particularly when dealing with authentication flows that involve multiple HTTP headers and status codes.