New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 617377 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner: ----
Closed: Jun 2016
Cc:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: ----
Type: Bug



Sign in to add a comment

Security: ssh_mine.run

Reported by jespervi...@gmail.com, Jun 4 2016

Issue description

This template is ONLY for reporting security bugs. If you are reporting a
Download Protection Bypass bug, please use the "Security - Download
Protection" template. For all other reports, please use a different
template.

Please see the following link for instructions on filing security bugs:
http://www.chromium.org/Home/chromium-security/reporting-security-bugs


VULNERABILITY DETAILS

When I try to search for a ssh_mine command in Google Chrome using the adress bar, I dont get a search result, but a name not resolved error. It seems like Chrome is executing the command instead of searching for it.


VERSION
Chrome Version: 49.0.2623112.m
Operating System: Windows Vista, service pack 2

REPRODUCTION CASE
Please include a demonstration of the security bug, such as an attached
HTML or binary file that reproduces the bug when loaded in Chrome. PLEASE
make the file as small as possible and remove any content not required to
demonstrate the bug.

In the address bar in Google chrome, type in "ssh_mine.run" (I wanted to search for that). You get the answer (danish):0

"Der kan ikke oprettes forbindelse til dette website

Serveren for ssh_mine.run DNS address kunne ikke findes.
ERR_NAME_NOT_RESOLVED"

Instead of a search result. It seems like the instruction is being executed.
 

Comment 1 by f...@chromium.org, Jun 5 2016

Cc: f...@chromium.org
Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Type-Bug
Status: WontFix (was: Unconfirmed)
Thanks for the report!

What's happening here is that Chrome thinks you are trying to navigate to a URL "http://ssh_mine.run". This happens because .run is a TLD just like .com. You can see the same thing if you type something like sldfkjsldfkjsldkfj.run or ssh_mine.com.

Sign in to add a comment