Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2022-32308
CVE-2022-32308:
Linux Debian vulnerability analysis and mitigation
Overview
Cross Site Scripting (XSS) vulnerability was discovered in uBlock Origin extension versions before 1.41.1. The vulnerability, identified as CVE-2022-32308, allowed remote attackers to execute arbitrary code via a spoofed 'MessageSender.url' to the browser renderer process (NVD).
Technical details
The vulnerability stemmed from the way uBlock Origin handled message sender URLs in its privilege verification system. The extension used 'MessageSender.url' to determine whether a port was privileged, but this could be spoofed by a compromised renderer process. This security flaw allowed attackers to perform sensitive actions, such as setting 'userResourcesLocation' and adding custom filters to perform XSS attacks (GitHub Issue).
Impact
The vulnerability could allow attackers to execute arbitrary code through the browser renderer process, potentially leading to cross-site scripting attacks. This could enable attackers to perform unauthorized actions with the privileges of the uBlock Origin extension (NVD).
Mitigation and workarounds
The vulnerability was fixed in uBlock Origin version 1.41.1. The recommended mitigation was to use 'MessageSender.origin' instead of 'MessageSender.url' for privilege level determination, as it is not spoofable in Chrome 80+ (GitHub Issue).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management