[CVE-2021-39246] Publish CVE-2021-39246

Author: sickcodes

advisories/SICK-2021-111.md

@@ -0,0 +1,106 @@
+### Title
+CVE-2021-39246 - Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack excessive verbose logging - Windows, macOS, Linux
+
+### CVE ID
+CVE-2021-39246
+
+### CVSS Score
+Pending
+
+### Internal ID
+SICK-2021-111
+
+# Vendor
+Tor 
+
+### Product
+Tor Browser on Windows, macOS, Linux
+
+### Product Versions
+10.5.6 and 11.x through 11.0a4
+
+### Vulnerability Details
+
+Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack that can compromise the privacy of visits to v2 onion addresses. If --log or --verbose is used, exact timestamps of these onion-service visits are logged locally, and an attacker might be able to compare them to timestamp data collected by the destination server (or collected by a rogue site within the Tor network).
+
+### Vendor Response
+Open pull request in relation to timestamp logging as v2 will be deprecated soon:
+
+[https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/434](https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/434).
+
+### Proof of Concept
+
+`Tor Browser` latest `10.5.6` is affected.
+
+`Tor Browser` alpha `11.0a4` is affected.
+
+This is because `Tor 0.4.6` introduced a warning every time a client connects to a v2 domain.
+
+See: [https://gitlab.torproject.org/tpo/core/tor/-/commit/5e836eb80c31b97f87b152351b6a7a932aeffaed](https://gitlab.torproject.org/tpo/core/tor/-/commit/5e836eb80c31b97f87b152351b6a7a932aeffaed)
+
+Also see "Log warning when connecting to soon-to-be-deprecated v2 onions."
+
+https://gitlab.torproject.org/tpo/core/tor/-/commit/80c404c4b79f3bcba3fc4585d4c62a62a04f3ed9
+
+
+```bash
+
+cd /tmp
+
+wget https://www.torproject.org/dist/torbrowser/10.5.6/tor-browser-linux64-10.5.6_en-US.tar.xz
+
+tar -xzvf tor-browser-linux64-10.5.6_en-US.tar.xz
+
+cd /tmp/tor-browser_en-US/
+
+./start-tor-browser.desktop --verbose
+
+# Launching './Browser/start-tor-browser --detach --verbose'...
+
+```
+
+Visit any v2 onion site, connection timestamps are logged at the exact moment the server responds.
+
+```console
+Sep 24 16:28:52.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline
+
+Sep 24 16:28:52.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline
+
+Sep 24 16:28:52.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline
+
+Sep 24 16:29:02.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline
+
+```
+
+#### Disclosure Timeline
+* **2021-07-02** - Researcher discovers vulnerability on bounty platform
+* **2021-07-07** - Report closed as informative
+* **2021-08-17** - Researcher requests CVE
+* **2021-08-17** - Vendor re-notified via sec mailing list, and on bounty platform chat.
+* **2021-09-10** - No response: researcher opens Pull Request to remove timestamps.
+* **2021-09-24** - CVE published
+
+### Links
+
+[https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-111.md](https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-111.md)
+
+[https://sick.codes/sick-2021-111](https://sick.codes/sick-2021-111)
+
+[https://www.privacyaffairs.com/cve-2021-39246-tor-vulnerability/](https://www.privacyaffairs.com/cve-2021-39246-tor-vulnerability/)
+
+[https://gitlab.torproject.org/tpo/core/tor/-/commit/80c404c4b79f3bcba3fc4585d4c62a62a04f3ed9](https://gitlab.torproject.org/tpo/core/tor/-/commit/80c404c4b79f3bcba3fc4585d4c62a62a04f3ed9)
+
+[https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/434](https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/434)
+
+### Researchers
+- *Sick Codes* [https://github.com/sickcodes](https://github.com/sickcodes) || [https://twitter.com/sickcodes](https://twitter.com/sickcodes)
+
+- *Miklos Zoltan* [https://twitter.com/mzb4455](https://twitter.com/mzb4455) || [https://www.privacyaffairs.com/authors/miklos/](https://www.privacyaffairs.com/authors/miklos/)
+
+#### CVE Links
+
+[https://sick.codes/sick-2021-111](https://sick.codes/sick-2021-111)
+
+[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39246](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39246)
+
+[https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-39246](https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-39246)