Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 7 Feb 2022 22:04:17 +0100
From: Gabriel Corona <gabriel.corona@...t-bretagne.fr>
To: oss-security@...ts.openwall.com
Subject: Browser-mediated attacks on WebDriver servers

Several browser-mediated attacks on WebDriver servers:

* GeckoDriver CSRF vulnerability (CVE-2020-15660);
* GeckoDriver DNS-rebinding vulnerability (CVE-2021-4138);
* Chromedriver localhost-bound same-site/cross-origin request forgery 
vulnerability;
* Selenium server/Grid CSRF vulnerability;
* Selenium server/Grid DNS-rebinding vulnerability.

In all cases this could be used to trigger arbitrary code execution.

GeckoDriver CSRF vulnerability
==============================

This is CVE-2020-15660. Fixed in GeckoDriver v0.27.0.

GeckoDriver DNS-rebinding vulnerability
=======================================

This is CVE-2021-4138. Fixed in GeckoDriver v0.30.0.

Chromedriver localhost-bound same-site/cross-origin request forgery
===================================================================

A XSS on another localhost-bound service could be exploited to trigger
arbitrary code execution.

Reference: https://bugs.chromium.org/p/chromium/issues/detail?id=1100097

Selenium server/Grid CSRF vulnerability
=======================================

A CVE-ID has been requested from MITRE.

This is fixed in SeleniumServer 4.

Selenium server/Grid DNS-rebinding vulnerability
====================================

A CVE-ID has been requested from MITRE.

This is fixed in SeleniumServer 4.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.