PT-2017-14952 · Samsung · Samsung Internet Browser

Dhiraj Mishra · Published 2017-12-21 · Updated 2018-01-09 · CVE-2017-17692

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Samsung Internet Browser version 5.4.02.3

Description The issue allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code. This is achieved by redirecting to a child tab and rewriting the innerHTML property.

Recommendations For Samsung Internet Browser version 5.4.02.3, consider disabling JavaScript execution in child tabs as a temporary workaround until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-17692

Affected Products

Samsung Internet Browser

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/samsung_browser_sop_bypass.rb · Exploit
• 🔥❌ https://github.com/lr3800/CVE-2017-17692 · Exploit, Deleted
• 🔥 https://exploit-db.com/exploits/43376 · Exploit
• 🔥 https://datarift.blogspot.tw/p/samsung-interent-browser-sop-bypass-cve.html · Exploit
• 🔥 https://datarift.blogspot.in/p/samsung-interent-browser-sop-bypass-cve.html · Exploit
• 🔥 http://packetstormsecurity.com/files/145510/Samsung-Internet-Browser-SOP-Bypass.html · Exploit
• https://osv.dev/vulnerability/CVE-2017-17692 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17692 · Security Note