qutebrowser 0.11.0 History Command cross site scripting

Summaryinfo

A vulnerability was found in qutebrowser 0.11.0. It has been classified as problematic. Impacted is an unknown function of the component History Command Handler. This manipulation causes cross site scripting. This vulnerability is handled as CVE-2018-1000559. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic was found in qutebrowser 0.11.0. Affected by this vulnerability is an unknown code block of the component History Command Handler. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. The summary by CVE is:

qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac21095358449) contains a Cross Site Scripting (XSS) vulnerability in history command, qute://history page that can result in Via injected JavaScript code, a website can steal the user's browsing history. This attack appear to be exploitable via the victim must open a page with a specially crafted <title> attribute, and then open the qute://history site via the :history command. This vulnerability appears to have been fixed in fixed in v1.3.3 (4c9360237f186681b1e3f2a0f30c45161cf405c7, to be released today) and v1.4.0 (5a7869f2feaa346853d2a85413d6527c87ef0d9f, released later this week).

The bug was discovered 06/22/2018. The weakness was released 06/26/2018 (Website). It is possible to read the advisory at github.com. This vulnerability is known as CVE-2018-1000559 since 06/22/2018. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 4 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 111426 (openSUSE Security Update : qutebrowser (openSUSE-2018-774)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family SuSE Local Security Checks and running in the context l.

Upgrading eliminates this vulnerability. A possible mitigation has been published 2 months after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (111426). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• qutebrowser

Version

• 0.11.0

License

• open-source

Website

• Product: https://github.com/qutebrowser/qutebrowser/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion