CVE-2022-0120

# THREAT ADVISORY: CVE-2022-0120 Chrome Password Leak Vulnerability **Advisory ID:** TA-2024-CVE-2022-0120 **Classification:** HIGH PRIORITY **Date:** December 19, 2024 --- ## Executive Summary **IMMEDIATE ACTION REQUIRED**: Your organization faces HIGH exposure to CVE-2022-0120, a Chrome vulnerability that allows malicious websites to leak cross-origin password data. With vulnerable Chrome versions (96.x or earlier) actively used for password entry across your environment, this creates a direct attack pathway for credential theft. While the vulnerability requires user interaction with malicious sites, the potential for credential compromise demands urgent remediation. --- ## Your Exposure Status **🔴 HIGH EXPOSURE CONFIRMED** Your organization meets all critical conditions for exploitation: - ✅ Google Chrome browsers in active use - ✅ Vulnerable versions (96.x or earlier) deployed - ✅ Users regularly entering passwords through Chrome - ✅ Potential exposure to malicious websites during normal browsing **Risk Assessment:** Remote attackers can potentially harvest cross-origin password data when users visit crafted malicious websites while using vulnerable Chrome versions. --- ## What This Means For You ### Immediate Threats - **Credential Harvesting**: Malicious websites can exploit password manager implementation flaws to leak sensitive authentication data - **Cross-Origin Data Exposure**: Attackers may access password information intended for different domains - **Supply Chain Risk**: Compromised websites or malicious ads could trigger exploitation during normal business operations ### Business Impact Scenarios - Compromise of corporate credentials and SSO accounts - Potential lateral movement if leaked credentials provide system access - Compliance violations if customer or employee passwords are exposed - Reputational damage from credential-related security incidents --- ## Recommended Actions ### IMMEDIATE (Within 24 Hours) 1. **Emergency Chrome Update Deployment** **For Organizations WITH Enterprise Tools (Group Policy/SCCM):** ```bash # Deploy Chrome 97.0.4692.71 or later immediately through your standard deployment tools # Use Group Policy Administrative Templates for Chrome # Push updates via SCCM software distribution ``` **For Organizations WITHOUT Enterprise Tools:** ```batch REM Create simple batch script for manual deployment @echo off echo Downloading Chrome installer... powershell -command "Invoke-WebRequest -Uri 'https://dl.google.com/chrome/install/GoogleChromeStandaloneEnterprise64.msi' -OutFile 'chrome_installer.msi'" echo Installing Chrome... msiexec /i chrome_installer.msi /quiet /norestart echo Update complete ``` **Manual Steps for Small Environments:** - Download Chrome Enterprise installer from Google's admin console - Create shared network location with installer - Send users direct download link: `https://www.google.com/chrome/` - Use remote desktop tools to manually update critical systems 2. **Inventory Vulnerable Installations** **Working PowerShell Commands:** ```powershell # Method 1: Check registry (works for most installations) Get-ItemProperty "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" | Select DisplayVersion # Method 2: Direct executable check & "C:\Program Files\Google\Chrome\Application\chrome.exe" --version # Method 3: For user-profile installations Get-ItemProperty "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" | Select DisplayVersion ``` **Simple Command Line Check:** ```cmd chrome.exe --version ``` **Manual Verification:** - Open Chrome → Help → About Google Chrome - Look for version number (must be 97.0.4692.71 or higher) 3. **Issue User Advisory** - Send immediate communication warning users about visiting suspicious websites - Advise temporary use of alternative browsers for sensitive password operations - Provide clear update instructions for self-managed devices ### SHORT-TERM (Within 1 Week) 1. **Comprehensive Update Verification** - Audit all Chrome installations across workstations, servers, and mobile devices - Verify successful deployment of Chrome 97.0.4692.71 or later - Document any systems requiring manual intervention 2. **Password Security Review** - Audit password manager configurations and policies - Review cross-origin resource sharing (CORS) policies on internal applications - Consider mandatory password resets for high-privilege accounts 3. **Enhanced Monitoring Implementation** - Deploy web traffic monitoring for suspicious cross-origin requests - Implement DNS monitoring for known malicious domains - Review proxy logs for potential exploitation attempts ### STRATEGIC (Within 1 Month) 1. **Browser Management Enhancement** - Implement automated Chrome update policies - Deploy enterprise browser management solutions - Establish vulnerability response procedures for browser-based threats 2. **Defense-in-Depth Improvements** - Evaluate web application firewalls for cross-origin attack prevention - Review and strengthen password policies and multi-factor authentication - Implement network segmentation to limit credential exposure impact --- ## Detection & Monitoring ### For Organizations WITH SIEM/Advanced Logging ```sql -- Example SIEM query for suspicious cross-origin requests SELECT timestamp, src_ip, dest_url, user_agent FROM web_logs WHERE user_agent LIKE '%Chrome/96%' AND dest_url CONTAINS 'password' AND response_code = 200 ``` ### For Organizations WITHOUT SIEM (Basic Monitoring) **Windows Event Log Monitoring:** ```powershell # Check for unusual network connections Get-WinEvent -FilterHashtable @{LogName='Security'; ID=5156} | Where-Object {$_.Message -like "*chrome*"} | Select TimeCreated, Message ``` **Manual Log Review Procedures:** 1. **Proxy Logs** (if available): - Look for Chrome/96.x user agents in access logs - Search for requests to recently registered domains - Monitor POST requests with password-related parameters 2. **Router/Firewall Logs:** - Check for unusual outbound connections during business hours - Look for connections to suspicious or newly registered domains 3. **Free Network Monitoring Tools:** - Use Wireshark for packet capture on critical systems - Deploy Nagios Core for basic network monitoring - Utilize Windows Resource Monitor for connection tracking **Simple Detection Steps:** ```batch REM Check running Chrome processes and versions tasklist /fi "imagename eq chrome.exe" /fo table /v wmic process where "name='chrome.exe'" get ProcessId,PageFileUsage,CommandLine ``` ### Immediate Indicators - Unusual cross-origin requests in web application logs - Unexpected password manager behavior reports from users - Suspicious outbound connections to recently registered domains ### Log Sources to Monitor ``` Web Proxy Logs: Look for requests to suspicious domains with password-related parameters DNS Logs: Monitor for queries to newly registered or suspicious domains Chrome Browser Logs: Review for password manager errors or unexpected behavior Network Traffic: Watch for unusual POST requests containing credential-like data Windows Event Logs: Security log ID 5156 for network connections Router/Firewall Logs: Outbound connection monitoring ``` --- ## Compliance Considerations - **SOC 2**: This vulnerability affects access controls and system security - **ISO 27001**: Requires documented incident response and vulnerability management - **HIPAA**: Password exposure could lead to unauthorized PHI access - **PCI-DSS**: Credential compromise may impact cardholder data security - **GDPR**: Password leaks constitute personal data breaches requiring notification --- ## References - **CVE Details**: [CVE-2022-0120](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0120) - **Chrome Security Advisory**: [Chrome Releases Blog](https://chromereleases.googleblog.com/) - **Google Chrome Enterprise**: [Update Management](https://support.google.com/chrome/a/answer/6350036) - **NIST Vulnerability Database**: [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2022-0120) --- **Next Review Date:** December 26, 2024 **Advisory Contact:** CISO Office **Escalation Required:** If Chrome updates cannot be deployed within 48 hours