Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
  • Loading branch information
sickcodes committed Sep 24, 2021
1 parent aacbcac commit c999864
Showing 1 changed file with 106 additions and 0 deletions.
106 changes: 106 additions & 0 deletions advisories/SICK-2021-111.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,106 @@
### Title
CVE-2021-39246 - Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack excessive verbose logging - Windows, macOS, Linux

### CVE ID
CVE-2021-39246

### CVSS Score
Pending

### Internal ID
SICK-2021-111

# Vendor
Tor

### Product
Tor Browser on Windows, macOS, Linux

### Product Versions
10.5.6 and 11.x through 11.0a4

### Vulnerability Details

Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack that can compromise the privacy of visits to v2 onion addresses. If --log or --verbose is used, exact timestamps of these onion-service visits are logged locally, and an attacker might be able to compare them to timestamp data collected by the destination server (or collected by a rogue site within the Tor network).

### Vendor Response
Open pull request in relation to timestamp logging as v2 will be deprecated soon:

[https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/434](https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/434).

### Proof of Concept

`Tor Browser` latest `10.5.6` is affected.

`Tor Browser` alpha `11.0a4` is affected.

This is because `Tor 0.4.6` introduced a warning every time a client connects to a v2 domain.

See: [https://gitlab.torproject.org/tpo/core/tor/-/commit/5e836eb80c31b97f87b152351b6a7a932aeffaed](https://gitlab.torproject.org/tpo/core/tor/-/commit/5e836eb80c31b97f87b152351b6a7a932aeffaed)

Also see "Log warning when connecting to soon-to-be-deprecated v2 onions."

https://gitlab.torproject.org/tpo/core/tor/-/commit/80c404c4b79f3bcba3fc4585d4c62a62a04f3ed9


```bash

cd /tmp

wget https://www.torproject.org/dist/torbrowser/10.5.6/tor-browser-linux64-10.5.6_en-US.tar.xz

tar -xzvf tor-browser-linux64-10.5.6_en-US.tar.xz

cd /tmp/tor-browser_en-US/

./start-tor-browser.desktop --verbose

# Launching './Browser/start-tor-browser --detach --verbose'...

```

Visit any v2 onion site, connection timestamps are logged at the exact moment the server responds.

```console
Sep 24 16:28:52.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline

Sep 24 16:28:52.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline

Sep 24 16:28:52.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline

Sep 24 16:29:02.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline

```

#### Disclosure Timeline
* **2021-07-02** - Researcher discovers vulnerability on bounty platform
* **2021-07-07** - Report closed as informative
* **2021-08-17** - Researcher requests CVE
* **2021-08-17** - Vendor re-notified via sec mailing list, and on bounty platform chat.
* **2021-09-10** - No response: researcher opens Pull Request to remove timestamps.
* **2021-09-24** - CVE published

### Links

[https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-111.md](https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-111.md)

[https://sick.codes/sick-2021-111](https://sick.codes/sick-2021-111)

[https://www.privacyaffairs.com/cve-2021-39246-tor-vulnerability/](https://www.privacyaffairs.com/cve-2021-39246-tor-vulnerability/)

[https://gitlab.torproject.org/tpo/core/tor/-/commit/80c404c4b79f3bcba3fc4585d4c62a62a04f3ed9](https://gitlab.torproject.org/tpo/core/tor/-/commit/80c404c4b79f3bcba3fc4585d4c62a62a04f3ed9)

[https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/434](https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/434)

### Researchers
- *Sick Codes* [https://github.com/sickcodes](https://github.com/sickcodes) || [https://twitter.com/sickcodes](https://twitter.com/sickcodes)

- *Miklos Zoltan* [https://twitter.com/mzb4455](https://twitter.com/mzb4455) || [https://www.privacyaffairs.com/authors/miklos/](https://www.privacyaffairs.com/authors/miklos/)

#### CVE Links

[https://sick.codes/sick-2021-111](https://sick.codes/sick-2021-111)

[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39246](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39246)

[https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-39246](https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-39246)

0 comments on commit c999864

Please sign in to comment.