JVN#40039627: Chrome Extension for e-Tax Reception System vulnerable to arbitrary command execution

Chrome Extension for e-Tax Reception System provided by National Tax Agency is an extension to use the e-Tax Reception System on Google Chrome and/or Chromium-based versions of Microsoft Edge. When a user runs a Chrome Extension for e-Tax Reception System, a specially crafted parameter by an attacker is fed to the Chrome Extension for e-Tax Reception and COM objects are manipulated, which may result in arbitrary command execution.

Impact

A remote attacker may execute an arbitrary command.

Solution

Update the Chrome Extension for e-Tax Reception System
Update Chrome Extension for e-Tax Reception System to the latest version according to the information provided by the developer.

Products Affected

• Chrome Extension for e-Tax Reception System Ver1.0.0.0