PT-2021-4872 · Unknown · Recaptcha Solver

Dozz · Published 2021-08-21 · Updated 2021-08-30 · CVE-2021-39362

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ReCaptcha Solver version 5.7

Description A security issue was discovered in ReCaptcha Solver, related to the handling of responses from certain servers, including Anti-Captcha.com, RuCaptcha.com, 2captcha.com, DEATHbyCAPTCHA.com, ImageTyperz.com, and BestCaptchaSolver.com. The setCaptchaCode() function inserts these responses into the DOM as HTML, allowing for full control over the user's browser. This issue is associated with a lack of protection for the web page structure, potentially enabling a remote attacker to gain control over the browser.

Recommendations For ReCaptcha Solver version 5.7, consider disabling the setCaptchaCode() function until a patch is available to prevent the insertion of potentially malicious HTML into the DOM. Restrict access to the DOM to minimize the risk of exploitation. Avoid using the responses from the mentioned servers in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-05602

CVE-2021-39362

Affected Products

Recaptcha Solver

References · 7

• https://bdu.fstec.ru/vul/2021-05602 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-39362 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39362 · Vendor Advisory
• https://vuldb.com/?id.181277 · Note
• https://t.me/cvenotify/20374 · Telegram Post
• https://thesamarkand.tumblr.com/post/660171228514009088/xss-vulnerability-in-recaptcha-solver-by-dozz · Note
• https://t.me/cvenotify/19869 · Telegram Post