CVE-2021-20791

Vulnerability

Improper access control (CWE-284) in RevoWorks Browser versions 2.1.230 and earlier allows an attacker to bypass access restrictions between the local environment and the isolated environment (a virtual browser for internet isolation). The vulnerability enables unauthorized file exchange or alteration of browser settings via unspecified vectors. According to the developer, RevoWorks Browser 2.0.x is not affected [1].

Exploitation

An attacker with local access and low privileges (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) can exploit this vulnerability without user interaction. The attack complexity is low. The attacker can exchange unauthorized files between the local and isolated environments or modify browser settings [1].

Impact

Successful exploitation results in unauthorized file exchange between the local and isolated environments, leading to low confidentiality and integrity impacts. The scope is changed, meaning the vulnerable component affects resources beyond its security boundary. The attacker may also alter browser settings [1].

Mitigation

The developer has released RevoWorks Browser version 2.2.50, which addresses this vulnerability. Users should update to the latest version. No workarounds are documented. Versions 2.0.x are not affected [1].