Saturday, July 13, 2024
EHA

Magellan 2.0 – Multiple Chrome Vulnerabilities that Exists in SQLite Let Hackers Execute Arbitrary Code Remotely

Critical SQLite vulnerabilities named “Magellan 2.0” discovered in World’s most popular browser Google Chrome let hackers exploit the Chromium render process and execute the remote code.

SQLite is a well-known database that widely used in popular embedded database software, and SQLite is a popular choice for local/client storage in application software such as web browsers and operating systems.

The vulnerability affects the users who all are using Chrome that is prior to 79.0.3945.79 with WebSQL enabled, and the researchers confirmed that the other devices such as PC/Mobile devices/IoT devices may also be affected depends on the attack surface.

The vulnerability was initially discovered by the Tencent Blade Team, and they have successfully tested in Chrome and exploited the vulnerability in Chromium render process.

https://twitter.com/tencent_blade/status/1209291255957508097

Magellan 2.0 Vulnerability details

The vulnerabilities mainly affected the software that is using SQLite as a component, and it supports external SQL queries. Attackers taking advantage of the vulnerabilities to perform remote code execution that leaking program memory or causing program crashes.

The vulnerabilities can be tracked as the following CVE: CVE-2019-13734, CVE-2019-13750, CVE-2019-13751, CVE-2019-13752, CVE-2019-13753.

 According to Tencent report, “Magellan” referred to a group of vulnerabilities, and if the Browsers with WebSQL enabled meets the following conditions may be affected the vulnerabilities.

  • Chrome/Chromium prior to version 79.0.3945.79 (Hereinafter referred to as “old version”).
  • Smart devices using an old version of Chrome/Chromium.
  • Browsers built with the old version of Chromium/Webview.
  • Android Apps that uses an old version of Webview and can access any web page.
  • Software that uses the old version of Chromium and can access any web page.

There is no evidence found that the vulnerabilities neither exploited nor exploit code available in public.

Researchers denied disclosing the details of the vulnerabilities since the bug has 90 days disclosure policy.

https://twitter.com/tencent_blade/status/1209291425369579521

SQLite and Google have already confirmed and fixed it and Google released the official Chrome version 79.0.3945.79.

Mitigation:

1.Up-to-date Chrome or SQLite with the newest commit patched
2.Your database does not accept external SQL queries.
3. Your browser has disabled WebSQL

Website

Latest articles

mSpy Data Breach: Millions of Customers’ Data Exposed

mSpy, a widely used phone spyware application, has suffered a significant data breach, exposing...

Advance Auto Parts Cyber Attack: Over 2 Million Users Data Exposed

RALEIGH, NC—Advance Stores Company, Incorporated, a prominent commercial entity in the automotive industry, has...

Hackers Using ClickFix Social Engineering Tactics to Deploy Malware

Cybersecurity researchers at McAfee Labs have uncovered a sophisticated new method of malware delivery,...

Coyote Banking Trojan Attacking Windows Users To Steal Login Details

Hackers use Banking Trojans to steal sensitive financial information. These Trojans can also intercept...

Hackers Created 700+ Fake Domains to Sell Olympic Games Tickets

As the world eagerly anticipates the Olympic Games Paris 2024, a cybersecurity threat has...

Japanese Space Agency Spotted zero-day via Microsoft 365 Services

The Japan Aerospace Exploration Agency (JAXA) has revealed details of a cybersecurity incident that...

Top 10 Active Directory Management Tools – 2024

Active Directory Management Tools are essential for IT administrators to manage and secure Active...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles