CVE-2011-3887 - Reliance on Cookies without Validation and Integrity Checking

Severity

50%

Complexity

99%

Confidentiality

48%

Google Chrome before 15.0.874.102 does not properly handle javascript: URLs, which allows remote attackers to bypass intended access restrictions and read cookies via unspecified vectors.

Google Chrome before 15.0.874.102 does not properly handle javascript: URLs, which allows remote attackers to bypass intended access restrictions and read cookies via unspecified vectors.

CVSS 2.0 Base Score 5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N).

Demo Examples

Reliance on Cookies without Validation and Integrity Checking

CWE-565

The following code excerpt reads a value from a browser cookie to determine the role of the user.


               
}
}
userRole = c.getValue();

It is easy for an attacker to modify the "role" value found in the locally stored cookie, allowing privilege escalation.

Overview

First reported 13 years ago

2011-10-25 19:55:00

Last updated 4 years ago

2020-05-08 13:40:00

Affected Software

Apple Safari

References

http://code.google.com/p/chromium/issues/detail?id=98407

http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html

Vendor Advisory

APPLE-SA-2012-03-07-2

APPLE-SA-2012-03-12-1

48288

48377

1026774

google-chrome-uri-sec-bypass(70965)

oval:org.mitre.oval:def:13179

http://code.google.com/p/chromium/issues/detail?id=98407

Permissions Required

APPLE-SA-2012-03-07-2

Mailing List, Third Party Advisory

APPLE-SA-2012-03-12-1

Mailing List, Third Party Advisory

48288

Third Party Advisory

48377

Third Party Advisory

1026774

Third Party Advisory, VDB Entry

google-chrome-uri-sec-bypass(70965)

Third Party Advisory, VDB Entry

oval:org.mitre.oval:def:13179

Third Party Advisory

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.