CVE-2016-1617 in Chrome
Summary
by MITRE
The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 48.0.2564.82, does not apply http policies to https URLs and does not apply ws policies to wss URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/06/2022
The vulnerability described in CVE-2016-1617 resides within the Content Security Policy implementation of the Blink rendering engine used in Google Chrome browsers prior to version 48.0.2564.82. This flaw specifically affects the CSPSource::schemeMatches function located in WebKit/Source/core/frame/csp/CSPSource.cpp, which is responsible for validating whether content source schemes match the policies defined by Content Security Policy headers. The issue stems from an incomplete implementation of scheme matching logic that fails to properly enforce security policies across different protocol schemes, creating a subtle but significant bypass mechanism.
The technical flaw manifests when the Content Security Policy engine processes URLs with different schemes, particularly affecting the relationship between http and https protocols as well as ws and wss protocols. When a web application enforces CSP policies that should apply to https resources, the vulnerable implementation fails to properly validate these policies, allowing http policies to be bypassed when applied to https URLs. Similarly, websocket policies designed for wss connections are not properly enforced against wss URLs. This inconsistency creates a scenario where attackers can infer the presence of specific HSTS domains by analyzing CSP violation reports generated when attempting to access resources from those domains, effectively enabling tracking of user browsing behavior without explicit consent or awareness.
The operational impact of this vulnerability extends beyond simple information disclosure, creating a potential privacy breach mechanism that adversaries can exploit to determine which secure websites a user has visited. This vulnerability directly relates to CWE-200, Information Exposure, and can be categorized under ATT&CK technique T1566 for credential access through web application attacks. The ability to infer browsing history through CSP reporting creates a sophisticated tracking mechanism that undermines the privacy protections that HSTS and CSP are designed to provide. Attackers can leverage this information to build detailed profiles of user behavior and potentially identify sensitive websites that users have visited, which could be particularly damaging in contexts involving political dissidents, journalists, or individuals in high-risk situations where browsing history privacy is paramount.
The vulnerability demonstrates a classic case of incomplete security policy enforcement where protocol scheme validation fails to consider the security implications of cross-scheme matching. This flaw represents a failure in the security boundary enforcement mechanisms that should prevent such policy bypasses. Organizations should consider this vulnerability as part of broader web application security assessments and ensure that all browsers are updated to versions that properly implement CSP scheme matching. The fix for this vulnerability required modifications to the CSP implementation to ensure that policies are properly enforced regardless of the scheme used, with specific attention to ensuring that http policies are applied to https URLs and that ws policies are properly enforced against wss connections. This represents a fundamental requirement for maintaining the integrity of web security mechanisms and preventing the exploitation of subtle implementation flaws that can undermine user privacy and security protections.