Cross-site Request Forgery (CSRF) Affecting chromium package, versions [,129.0.6626.0)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-UNMANAGED-CHROMIUM-7654159
- published 9 Aug 2024
- disclosed 6 Aug 2024
- credit Avi Lumelsky
How to fix?
Upgrade chromium to version 129.0.6626.0 or higher.
Overview
Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) against the 0.0.0.0 address, which is not included in the Private Network Access specification. Browser implementations that allow treating this address as a destination for requests may expose the application to DNS rebinding attacks or remote code execution. This is a common scenario because all traffic involving 0.0.0.0 is presumed to be local and therefore the same safeguards may not be in place as would be for a normal remote request. CORS protections do not strictly need to be bypassed because no response is needed for code execution to succeed.
Workarounds
This vulnerability can be avoided by various means including implementing PNA headers, CSRF tokens, HTTPS or host authorization checks - even for local requests.