Thursday, March 28, 2024

Critical Microsoft Edge Vulnerability leads to Bypass the Password and Cookie Theft – Still Not Yet Patched

[jpshare]Critical Microsoft Edge Vulnerability Allows to  steal  the cookies and password revealed by Recent Research by  PoC (Proof-of-Concepts) .This Vulnerability Discovered under bypass the Same Origin Policy (SOP).

This Vulnerability Allows to Bypass the victims cookies by force  them to access the Malicious URL in Microsoft Edge browser.

This Vulnerability has  been tested in Twitter Account by twit with Malicious URL and trick the  active session twitter Account Holder to click the link .

Researcher Explained with (Proof-of-Concepts),  Victims Clicks the link in Microsoft Edge browser,  its will pop-up to the another Window which contain some information which makes to victim keep busy with Reading the particular page which popped up the new Window.

According to Researcher Victim opened a new inPrivate window and loaded the URL that Attacker sent him. What he didn’t know was that browser windows, even inPrivate, can communicate with each other.

window.open(“javascript:alert(document.cookie)”, “dm-post-iframe”);
 
Once Execute the above Code finally Cookie will be Popup in Victims window.
 
 

This Security Flow attacker’s ability to logout a user, load the login page, and steal the user’s credentials that are automatically filled in by the browser’s password autofill feature.

TRY THIS DEMO

This Proof of Concepts Discover by the Edge Browser Hidden Auto fill future which leads to force the victims Logout the  session and Log in again. Researcher Said.

Attackers use malvertising:

According to  Malwarebytes ,malvertising Act Without your knowledge a tiny piece of code hidden deep in the advert is making your computer go to criminal servers.

It will deploying their bad bits inside cheap banners from popular sites. If an attacker is hosted inside a Yahoo banner and the user is logged in into her Twitter account, she will be owned with no interactions, at all.

These then catalogue details about your computer and its location, before choosing which piece of malware to send you. This doesn’t need a new browser window and you won’t know about it.

Currently Unpatched This Security Flow:

This vulnerability is  Still Not Yet patched, This Vulnerability  Versions of the proof-of-concept demos are explained in online [1, 2, 3] .

Caballero is providing the demos for download, so others can inspect the source code and make sure their passwords and cookies aren’t uploaded anywhere.

Also Researcher said ,Before running the PoC, consider that it is your account the one that will be exposed, Nothing is being sent to the network but if there’s somebody behind you, she will see your password in a regular alert dialog. Watch out!

Also Read :

WordPress vulnerable to Cross-Site Request Forgery in Connection Information – Not yet fixed with last Update

Risk with Steganography and Importance of running Steganalysis with Network Systems

Using n1n3 to Simulate an evasive “Fileless” Malware – Proof Of Concept

Website

Latest articles

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles