Quantum Secular Labs / Blog / Advisories

CVE-2017-20202: Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a…

CVE-2017-20202 is rated critical with a CVSS v4.0 base score of 9.3. Per its scoring, it can be exploited over the network, without authentication.

Vulnerability description

Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to affiliate programs, and attempted to harvest credentials when users logged in. Injected components enumerate common banner sizes for substitution, replace third-party ad calls, and redirect victim traffic to affiliate landing pages. Potential impacts include user-level code execution in the browser context, large-scale ad fraud and traffic hijacking, credential theft, and exposure to additional payloads delivered by the actor. The compromise was reported on by the maintainer of Web Developer for Chrome on August 2, 2017 and remediated in v0.5.0.

Severity breakdown

CVSS v4.0 9.3: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Attack vector: Network. Exploitable remotely over the network.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Attack requirements: None. No deployment or execution conditions are needed.
  • Privileges required: None. No account or prior access is needed.
  • User interaction: Active. A user must knowingly take specific action.
  • Confidentiality impact (vulnerable system): High. Total loss of confidentiality.
  • Integrity impact (vulnerable system): High. Total loss of integrity.
  • Availability impact (vulnerable system): None. No effect on availability.
  • Confidentiality impact (subsequent systems): High. Total loss of confidentiality on other systems.
  • Integrity impact (subsequent systems): High. Total loss of integrity on other systems.
  • Availability impact (subsequent systems): None. No availability impact beyond the vulnerable system.

Underlying weakness

CWE-506: Embedded Malicious Code

The product contains code that appears to be malicious in nature.

Affected products

    References