关联漏洞
标题：
Tor Browser 安全漏洞
(CVE-2021-46702)
描述：Tor Browser是一款用于匿名访问互联网的浏览器。 Tor Browser 存在安全漏洞，该漏洞可以让本地攻击者可利用该漏洞绕过预期的匿名特性，并获得有关本地用户访问的洋葱服务的信息。这可以通过在本地用户使用产品几个小时后分析RAM内存来完成。这是因为产品没有正确释放内存。
描述
Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could allow local attackers to bypass the intended anonymity feature and obtain information regarding the onion services visited by a local user. This can be accomplished by analyzing RAM memory even several hours after the local user used the product. This occurs because the product doesn't properly free memory.
介绍
# CVE-2021-46702
# Description:
Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could allow local attackers to bypass the intended anonymity feature and obtain information regarding the onion services visited by a local user. This can be accomplished by analyzing RAM memory even several hours after the local user used the product. This occurs because the product doesn't properly free memory.
# Tested Version:
Tor Browser - 9.0.7
# Vendor of Product
https://www.torproject.org/
# Attack Type
Local
# Impact
Information Disclosure
# Reference
https://www.sciencedirect.com/science/article/pii/S0167404821001358
# POC Requirements
For the PoC.sh to work, a memory dump of the user work station should be granted. It will provide information about visited sites even after 10 hours from the user interaction.
You can find the shell script that automate the process of finding the visited onion services in the files section. The following Figure shows the Report file output which indicates the visited sites and additional information:
<img width="826" alt="Screenshot 2022-02-26 at 17 40 35" src="https://user-images.githubusercontent.com/38157380/155847153-38f17ca3-92b2-47fb-bcf3-f7ee47c28d0a.png">
# Discoverer
Malak Alfosail
# Twitter: @malakalfosail
文件快照
[4.0K] /data/pocs/d45e3c45e042387c66e6182eb9c361abcc75c3fa
├── [1.8K] PoC.sh
└── [1.3K] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。