CVE-2021-43844

{"id": "CVE-2021-43844", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-12-20T22:15:07.883", "references": [{"url": "https://github.com/rcmaehl/MSEdgeRedirect/releases/tag/0.5.0.1", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rcmaehl/MSEdgeRedirect/security/advisories/GHSA-95v4-748v-fmf9", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-610"}]}], "descriptions": [{"lang": "en", "value": "MSEdgeRedirect is a tool to redirect news, search, widgets, weather, and more to a user's default browser. MSEdgeRedirect versions before 0.5.0.1 are vulnerable to Remote Code Execution via specifically crafted URLs. This vulnerability requires user interaction and the acceptance of a prompt. With how MSEdgeRedirect is coded, parameters are impossible to pass to any launched file. However, there are two possible scenarios in which an attacker can do more than a minor annoyance. In Scenario 1 (confirmed), a user visits an attacker controlled webpage; the user is prompted with, and downloads, an executable payload; the user is prompted with, and accepts, the aforementioned crafted URL prompt; and RCE executes the payload the user previously downloaded, if the download path is successfully guessed. In Scenario 2 (not yet confirmed), a user visits an attacked controlled webpage; the user is prompted with, and accepts, the aforementioned crafted URL prompt; and a payload on a remote, attacker controlled, SMB server is executed. The issue was found in the _DecodeAndRun() function, in which I incorrectly assumed _WinAPI_UrlIs() would only accept web resources. Unfortunately, file:/// passes the default _WinAPI_UrlIs check(). File paths are now directly checked for and must fail. There is no currently known exploitation of this vulnerability in the wild. A patched version, 0.5.0.1, has been released that checks for and denies these crafted URLs. There are no workarounds for this issue. Users are advised not to accept any unexpected prompts from web pages."}, {"lang": "es", "value": "MSEdgeRedirect es una herramienta para redirigir las noticias, la b\u00fasqueda, los widgets, el tiempo, etc. al navegador predeterminado del usuario. MSEdgeRedirect versiones anteriores a 0.5.0.1 son vulnerables a una ejecuci\u00f3n de c\u00f3digo remota por medio de URLs espec\u00edficamente dise\u00f1adas. Esta vulnerabilidad requiere una interacci\u00f3n del usuario y la aceptaci\u00f3n de una solicitud. Con la forma en que est\u00e1 codificado MSEdgeRedirect, es imposible pasar par\u00e1metros a cualquier archivo lanzado. Sin embargo, se presentan dos posibles escenarios en los que un atacante puede hacer algo m\u00e1s que una peque\u00f1a molestia. En el escenario 1 (confirmado), un usuario visita una p\u00e1gina web controlada por el atacante; le es pedido al usuario que descargue una carga \u00fatil ejecutable; le es pedido al usuario que acepte el aviso de la URL dise\u00f1ada antes mencionado; y el RCE ejecuta la carga \u00fatil que el usuario descarg\u00f3 previamente, si es adivinada la ruta de descarga. En el escenario 2 (a\u00fan no confirmado), un usuario visita una p\u00e1gina web controlada por el atacante; le es pedido al usuario que acepte la solicitud de URL dise\u00f1ada antes mencionada; y es ejecutado una carga \u00fatil en un servidor SMB remoto controlado por el atacante. El problema es encontrado en la funci\u00f3n _DecodeAndRun(), en la que asum\u00ed incorrectamente que _WinAPI_UrlIs() s\u00f3lo aceptaba recursos web. Desafortunadamente, file:/// pasa la comprobaci\u00f3n _WinAPI_UrlIs() por defecto. Ahora son comprobados directamente las rutas de los archivos y deben fallar. Actualmente no es conocido ninguna explotaci\u00f3n de esta vulnerabilidad \"in the wild\". Ha sido publicado una versi\u00f3n parcheada, 0.5.0.1, que comprueba y rechaza estas URLs dise\u00f1adas. No se presentan soluciones para este problema. Se aconseja a usuarios que no acepten ninguna petici\u00f3n no esperada de las p\u00e1ginas web"}], "lastModified": "2022-01-04T17:15:29.040", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:msedgeredirect_project:msedgeredirect:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BEFA729C-F38A-409D-9A03-B87DB276F497", "versionEndExcluding": "0.5.0.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}