CVE-2018-18358 Server-side request forgery in Chrome
An attacker on the local network can proxy localhost resources via a crafted WPAD file due to missing localhost special casing in Chrome.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-18358?
CVE-2018-18358 is a medium-severity server-side request forgery vulnerability in Debian Debian Linux, published on 11 Dec 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Lack of special casing of localhost in WPAD files in Google Chrome prior to 71.0.3578.80 allowed an attacker on the local network segment to proxy resources on localhost via a crafted WPAD file.
Weakness: CWE-20
Which versions are affected by CVE-2018-18358?
It affects 5 products.
Products include Debian Debian Linux, Google Chrome, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation.
How do I fix CVE-2018-18358?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2018-18358 being exploited?
There is no known exploitation of CVE-2018-18358 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2018-18358, GHSA-x2qc-mfcw-3v2v, UBUNTU-CVE-2018-18358.