Microsoft Edge Content Security Bypass Vulnerability

Summary

An exploitable information leak vulnerability exists in the Content Security Policy enforcement functionality of Microsoft Edge 40.15063.0.0. A specially crafted web page can cause a content security policy bypass resulting in an information leak. An attacker can create a malicious webpage to trigger this vulnerability.

Tested Versions

Microsoft Edge 40.15063.0.0

Product URLs

<https://www.microsoft.com/en-us/windows/microsoft-edge&gt;

CVSSv3 Score

4.3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CWE

CWE-284: Improper Access Control

Details

An attacker can bypass the Content-Security-Policy header that is used to make the browser protect against information leakage from a web site.

By loading a new document using window.open(“”,”_blank”) and document.write-ing into it, (being in about:blank) an attacker can circumvent the CSP restrictions put on the document that the original page’s Javascript code was running on and reach out to other sites. One could argue that the code was loaded with unsafe-inline in the CSP header, but that should still block any cross-site communication (e.g. 1x1px tracking image etc).

The about:blank page has the same origin as its loading document, but CSP restrictions have been removed. The spec is pretty explicit that the CSP restrictions should be inherited: https://w3c.github.io/webappsec-csp/#initialize-document-csp.

Tests show that e.g. Firefox does not show this behavior, but rather makes the new document inherit CSP from its loading document. This vulnerability was also present in Apple Safari (CVE-2017-2419) and Google Chrome (CVE-2017-5033) and was corrected there.

Timeline

2016-11-29 - Initial vendor contact by Nicolai
2016-12-01 - Vendor confirms receipt
2017-01-04 - Follow up with Vendor
2017-01-04 - Vendor confirms reproduction
2017-03-06 - Follow up with Vendor
2017-03-07 - Vendor says this is by design and does not consider it a vulnerability
2017-03-07 - More information provided to vendor
2017-03-29 - Talos involvement, asks vendor to reconsider
2017-06-06 - Follow up with vendor
2017-06-07 - Vendor reopens case to reconsider
2017-08-22 - Vendor informed about pending release date
2017-09-06 - Public Release