CVE-2016-5137

Vulnerability

The Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before version 52.0.2743.82, contains a flaw in the CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp. Specifically, the function does not apply http :80 policies to https :443 URLs and does not apply ws :80 policies to wss :443 URLs [1]. This occurs because the specification change that allowed insecure ports to match secure ports in source expressions (a refinement addressing a previous issue) was not fully implemented in this version [1].

Exploitation

A remote attacker can craft a malicious website that includes a CSP directive (e.g., report-uri) with an insecure port (80) for an HSTS-protected site. When a user visits the attacker's site, Chrome will compare the CSP policy to the user's browsing history or ongoing connections. If the user has previously visited an HSTS site on port 443, the CSP violation report triggered by the attacker's policy will differ from a scenario where no such visit occurred. This allows the attacker to infer whether the user has visited a specific HSTS-enabled website [1]. No authentication or privileged network position is required; the user must only visit the attacker's site.

Impact

Upon successful exploitation, the attacker gains the ability to determine whether a specific HSTS website has been visited by reading a CSP report [1]. This is an information disclosure that violates the user's privacy by revealing browsing history. The attacker does not gain code execution or modify data; the impact is limited to sensitive information disclosure (confidentiality breach).

Mitigation

The vulnerability is fixed in Google Chrome version 52.0.2743.82, released on July 20, 2016 [2]. Users should update Chrome to this version or later. The update was also distributed through Red Hat (RHSA-2016:1485) [2], Ubuntu (USN-3041-1) [3], and Gentoo (GLSA 201610-09) [4]. There is no workaround for unpatched versions; the only mitigation is to apply the security update.

[1]: https://codereview.chromium.org/2125873003 [2]: http://rhn.redhat.com/errata/RHSA-2016-1485.html [3]: http://www.ubuntu.com/usn/USN-3041-1 [4]: https://security.gentoo.org/glsa/201610-09