VDB-12057 · OSVDB 102386 · GCVE-100-12057

Google Chrome 32.0.1700.95 Speech Recognition 权限提升

CVSS 元临时分数	当前攻击价格 (≈)	CTI兴趣分数
4.3	$0-$5k	0.00

摘要信息

检测到一个被分类为棘手的安全漏洞，影响Google Chrome 32.0.1700.95。被影响的是未知函数，属于Speech Recognition组件。当被操控时，会导致权限提升。另外，有可用的漏洞利用。

检测到一个被分类为棘手的安全漏洞，影响Google Chrome 32.0.1700.95。被影响的是未知函数，属于Speech Recognition组件。当被操控时，会导致权限提升。使用CWE来声明会导致 CWE-269 的问题。此安全漏洞在 2014-01-22 由Tal Ater 以Chrome Bugs Allow Sites to Listen to Your Private Conversations编号以Posting （网站）公开发布。索取公告的网址是talater.com。本次披露内容如下：

I discovered this exploit while working on annyang, a popular JavaScript Speech Recognition library.

暂无技术细节。该漏洞的普及率低于常规水平。另外，有可用的漏洞利用。目前漏洞的结构决定了可能的价格范围为美元价USD $0-$5k。根据MITRE ATT&CK，此问题部署的攻击技术是T1068。安全公告说明：

A user visits a site, that uses speech recognition to offer some cool new functionality. The site asks the user for permission to use his mic, the user accepts, and can now control the site with his voice. Chrome shows a clear indication in the browser that speech recognition is on, and once the user turns it off, or leaves that site, Chrome stops listening. So far, so good. But what if that site is run by someone with malicious intentions? Most sites using Speech Recognition, choose to use secure HTTPS connections. This doesn’t mean the site is safe, just that the owner bought a $5 security certificate. When you grant an HTTPS site permission to use your mic, Chrome will remember your choice, and allow the site to start listening in the future, without asking for permission again. This is perfectly fine, as long as Chrome gives you clear indication that you are being listened to, and that the site can’t start listening to you in background windows that are hidden to you. When you click the button to start or stop the speech recognition on the site, what you won’t notice is that the site may have also opened another hidden popunder window. This window can wait until the main site is closed, and then start listening in without asking for permission. This can be done in a window that you never saw, never interacted with, and probably didn’t even know was there. To make matters worse, even if you do notice that window (which can be disguised as a common banner), Chrome does not show any visual indication that Speech Recognition is turned on in such windows - only in regular Chrome tabs.

若有长度，则其被标记为概念验证。我们估计的零日攻击价值约为$100k 以及更多。

更新版本已可在chrome.google.com下载。