Monday, July 15, 2024
EHA

Critical Microsoft Edge Vulnerability leads to Bypass the Password and Cookie Theft – Still Not Yet Patched

[jpshare]Critical Microsoft Edge Vulnerability Allows to  steal  the cookies and password revealed by Recent Research by  PoC (Proof-of-Concepts) .This Vulnerability Discovered under bypass the Same Origin Policy (SOP).

This Vulnerability Allows to Bypass the victims cookies by force  them to access the Malicious URL in Microsoft Edge browser.

This Vulnerability has  been tested in Twitter Account by twit with Malicious URL and trick the  active session twitter Account Holder to click the link .

Researcher Explained with (Proof-of-Concepts),  Victims Clicks the link in Microsoft Edge browser,  its will pop-up to the another Window which contain some information which makes to victim keep busy with Reading the particular page which popped up the new Window.

According to Researcher Victim opened a new inPrivate window and loaded the URL that Attacker sent him. What he didn’t know was that browser windows, even inPrivate, can communicate with each other.

window.open(“javascript:alert(document.cookie)”, “dm-post-iframe”);
 
Once Execute the above Code finally Cookie will be Popup in Victims window.
 
 

This Security Flow attacker’s ability to logout a user, load the login page, and steal the user’s credentials that are automatically filled in by the browser’s password autofill feature.

TRY THIS DEMO

This Proof of Concepts Discover by the Edge Browser Hidden Auto fill future which leads to force the victims Logout the  session and Log in again. Researcher Said.

Attackers use malvertising:

According to  Malwarebytes ,malvertising Act Without your knowledge a tiny piece of code hidden deep in the advert is making your computer go to criminal servers.

It will deploying their bad bits inside cheap banners from popular sites. If an attacker is hosted inside a Yahoo banner and the user is logged in into her Twitter account, she will be owned with no interactions, at all.

These then catalogue details about your computer and its location, before choosing which piece of malware to send you. This doesn’t need a new browser window and you won’t know about it.

Currently Unpatched This Security Flow:

This vulnerability is  Still Not Yet patched, This Vulnerability  Versions of the proof-of-concept demos are explained in online [1, 2, 3] .

Caballero is providing the demos for download, so others can inspect the source code and make sure their passwords and cookies aren’t uploaded anywhere.

Also Researcher said ,Before running the PoC, consider that it is your account the one that will be exposed, Nothing is being sent to the network but if there’s somebody behind you, she will see your password in a regular alert dialog. Watch out!

Also Read :

WordPress vulnerable to Cross-Site Request Forgery in Connection Information – Not yet fixed with last Update

Risk with Steganography and Importance of running Steganalysis with Network Systems

Using n1n3 to Simulate an evasive “Fileless” Malware – Proof Of Concept

Website

Latest articles

Critical Cellopoint Secure Email Gateway Flaw Let Attackers Execute Arbitrary Code

A critical vulnerability has been discovered in the Cellopoint Secure Email Gateway, identified as...

Singapore Banks to Phase out OTPs for Bank Account Logins Within 3 Months

The Monetary Authority of Singapore (MAS) and The Association of Banks in Singapore (ABS)...

GuardZoo Android Malware Attacking military personnel via WhatsApp To Steal Sensitive Data

A Houthi-aligned group has been deploying Android surveillanceware called GuardZoo since October 2019 to...

ViperSoftX Weaponizing AutoIt & CLR For Stealthy PowerShell Execution

ViperSoftX is an advanced malware that has become more complicated since its recognition in...

Malicious NuGet Campaign Tricking Developers To Inject Malicious Code

Hackers often target NuGet as it's a popular package manager for .NET, which developers...

Akira Ransomware Attacking Airline Industry With Legitimate Tools

Airlines often become the target of hackers as they contain sensitive personal and financial...

DarkGate Malware Exploiting Excel Files And SMB File Shares

DarkGate, a Malware-as-a-Service (MaaS) platform, experienced a surge in activity since September 2023, employing...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles