CVE-2018-10895 Qutebrowser CSRF Vulnerability
A CSRF flaw in qutebrowser allows malicious websites to modify settings and execute arbitrary code via bash scripts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-10895?
CVE-2018-10895 is a critical vulnerability in qutebrowser cross-site request forgery flaw allows sites to access 'qute, published on 12 Jul 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access 'qute://*' URLs. A malicious website could exploit this to load a 'qute://settings/set' URL, which then sets 'editor.command' to a bash script, resulting in arbitrary code execution.
Weakness: CWE-352
Which versions are affected by CVE-2018-10895?
3 open source packages ship an affected version, including qutebrowser. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
qutebrowser PyPI | All versions | 1.4.1 |
qutebrowser PyPI | All versions | 1.4.1 |
qutebrowser PyPI | All versions | 1.4.1 |
Products include Qutebrowser Qutebrowser.
How do I fix CVE-2018-10895?
Upgrade qutebrowser to 1.4.1 or later.
Is CVE-2018-10895 being exploited?
There is no known exploitation of CVE-2018-10895 in the wild and no public exploit code.
Other vulnerabilities in qutebrowser cross-site request forgery flaw allows sites to access 'qute
Sources
Also known as DEBIAN-CVE-2018-10895, GHSA-wgmx-52ph-qqcw, PYSEC-2018-27, UBUNTU-CVE-2018-10895.