VULNERABILITY DETAILS

It has been discovered that the Google Chrome browser is prone to a URI obfuscation vulnerability that make users access a spoof website rather than the intended destination.

The problem occurs when a Chrome user visits the user@host URI which is formatted in such a way that (http://www.good.com@evil.com/), 'user' part contains actual site location and 'host' part contains the deceptive site location, it will cause it to strip the 'user' part and load the 'host' part without any user confirmation/notification.

This could be used in conjunction with other browser vulnerabilities to trick a user into following a malicious link.

Note: Other browsers have already fixed this vulnerability. Find the proof of concept screenshot taken using Firefox. 

VERSION

Chrome Version: [Version 53.0.2785.143 m]
Operating System: [Windows 8.1]


REPRODUCTION CASE

Follow any of the below listed links and observe that you'll be redirected to the host part of URI without any confirmation/notification

[+] https://www.google.com@www.google.com.vulnerabilities.in

[+]https://console.developers.google.com@www.google.com.vulnerabilities.in

[+] http://www.google.com.about.appsecurity.chrome-rewards.index@www.google.com.vulnerabilities.in


REMEDIATION

Browser must stop the load and confirm with the user that they are really visiting the site they expected to visit when 'user@host' kind of URI's are used


Best Regards,
Mohd Aqeel Ahmed
Cyber Professional Security Researcher

 

Deleted: chrome1.jpg 25.9 KB

	chrome1.jpg 25.9 KB View Download