Alacriti Browser Extension WebAuthn Missing Origin/RP Validation Vulnerability Advisory

Vulnerability Overview A vulnerability has been identified in the WebAuthn implementation of the Alacritty browser extension (passkey), affecting versions 0.2/3. This vulnerability allows an attacker to bypass origin and Relying Party (RP) validation, thereby supplying forged origins and RPs to the Alacritty passkey. When users utilize an affected Alacritty passkey, the extension generates valid WebAuthn credentials, while the server cannot verify whether these credentials originated from the correct website. This vulnerability may facilitate phishing attacks and could allow attackers to bypass two-factor authentication on websites. Impact Scope Affected Versions: 0.2/3 Fixed Version: 0.2/4 Affected Product: Alacritty Browser Extension Remediation Patch Implementation: - Verify that the passkey request originates from the correct website. - Verify that the RP matches the current website's domain. - Verify that the RP includes the correct request URL. Mitigation Measures: - Update the Alacritty browser extension to version 0.2/4 or higher. POC Code or Exploit Code No specific POC code or exploit code is included in the page. Timeline June 13, 2024, 13:29 UTC: The Alacritty team received a report regarding a verified POC. June 13, 2024, 15:29 UTC: The Alacritty team confirmed the vulnerability. June 23, 2024, 08:19 UTC: The vulnerability was publicly disclosed in Alacritty 0.2/4. June 23, 2024, 08:19 UTC: The security advisory was published. References https://github.com/alacritty/alacritty/security/advisories/GHSA-4q9q-2q9q-2q9q https://alacritty.org

Goal Reached Thanks to every supporter — we hit 100%!

Alacriti Browser Extension WebAuthn Missing Origin/RP Validation Vulnerability Advisory

More from this source