Google Chrome Cross Site Scripting Filter Security Bypass Vulnerability
BID:65066
Info
Google Chrome Cross Site Scripting Filter Security Bypass Vulnerability
| Bugtraq ID: | 65066 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 20 2014 12:00AM |
| Updated: | Jan 20 2014 12:00AM |
| Credit: | Ioseba Palop of Eleven Paths |
| Vulnerable: |
Google Chrome 31.0.1650.57 Google Chrome 31.0.1650.47 Google Chrome 31.0.1650.37 Google Chrome 31.0.1650.35 Google Chrome 31.0.1650.15 Google Chrome 28.0.1500.93 Google Chrome 28.0.1500.66 Google Chrome 28.0.1500.63 Google Chrome 28.0.1500.6 Google Chrome 28.0.1500.52 Google Chrome 28.0.1500.33 Google Chrome 28.0.1500.3 Google Chrome 28.0.1500.27 Google Chrome 28.0.1500.26 Google Chrome 28.0.1500.20 Google Chrome 28.0.1500.10 Google Chrome 27.0.1453.90 Google Chrome 27.0.1453.77 Google Chrome 27.0.1453.7 Google Chrome 27.0.1453.61 Google Chrome 27.0.1453.45 Google Chrome 27.0.1453.15 Google Chrome 27.0.1453.104 Google Chrome 26.0.1410.53 Google Chrome 25.0.1364.85 Google Chrome 25.0.1364.8 Google Chrome 25.0.1364.68 Google Chrome 25.0.1364.42 Google Chrome 25.0.1364.41 Google Chrome 25.0.1364.2 Google Chrome 25.0.1364.16 Google Chrome 25.0.1364.125 Google Chrome 25.0.1364.116 Google Chrome 25.0.1364.11 Google Chrome 25.0.1364.10 Google Chrome 25.0.1364.1 Google Chrome 24.0.1312.56 Google Chrome 24.0.1312.45 Google Chrome 24.0.1312.37 Google Chrome 24.0.1312.25 Google Chrome 24.0.1312.15 Google Chrome 24.0.1305.0 Google Chrome 24.0.1304.0 Google Chrome 24.0.1289.1 Google Chrome 24.0.1285.0 Google Chrome 24.0.1278.0 Google Chrome 24.0.1277.0 Google Chrome 23.0.1271.97 Google Chrome 23.0.1271.96 Google Chrome 23.0.1271.62 Google Chrome 23.0.1271.59 Google Chrome 23.0.1271.54 Google Chrome 23.0.1271.46 Google Chrome 23.0.1271.41 Google Chrome 23.0.1271.37 Google Chrome 23.0.1271.18 Google Chrome 23.0.1271.13 Google Chrome 22.0.1229.92 Google Chrome 22.0.1229.76 Google Chrome 22.0.1229.22 Google Chrome 21.0.1180.82 Google Chrome 21.0.1180.75 Google Chrome 21.0.1180.60 Google Chrome 21.0.1180.32 Google Chrome 20.0.1132.24 Google Chrome 20.0.1132.14 Google Chrome 20 |
| Not Vulnerable: |
Google Chrome 32.0.1700.76 |
Discussion
Google Chrome Cross Site Scripting Filter Security Bypass Vulnerability
Google Chrome is prone to a security-bypass vulnerability.
An attacker can exploit this vulnerability to bypass the cross-site scripting filter. Successful exploits may allow attackers to execute arbitrary script code and steal cookie-based authentication credentials.
Google Chrome is prone to a security-bypass vulnerability.
An attacker can exploit this vulnerability to bypass the cross-site scripting filter. Successful exploits may allow attackers to execute arbitrary script code and steal cookie-based authentication credentials.
Exploit / POC
Google Chrome Cross Site Scripting Filter Security Bypass Vulnerability
Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
Solution / Fix
Google Chrome Cross Site Scripting Filter Security Bypass Vulnerability
Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.
Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.
References
Google Chrome Cross Site Scripting Filter Security Bypass Vulnerability
References:
References:
- Google Chrome Homepage (Google)
- How to bypass antiXSS filter in Chrome and Safari (discovered by ElevenPaths) (Eleven Paths)