Executive Summary

Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in the securly.min.js file.

These passphrases are used to decrypt sensitive data such as crisis alert keyword data and intervention site data.

Useful 0 Not Useful 0

Impact Analysis

Because the AES passphrases are hardcoded and stored in plaintext, an attacker who accesses the extension's code can decrypt sensitive information.

This could lead to unauthorized access to crisis alert keyword data and intervention site data, potentially exposing sensitive or confidential information.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in version 3.0.7 of the Securly Chrome Extension involves hardcoded, plaintext AES passphrases that decrypt sensitive data such as crisis alert keyword data and intervention site data. This exposure of sensitive information could lead to unauthorized access or disclosure of personal or protected data.

Such unauthorized access or disclosure may impact compliance with data protection regulations like GDPR or HIPAA, which require adequate protection of sensitive personal data and mandate controls to prevent unauthorized access.

However, the provided context and resources do not explicitly discuss the direct impact on compliance with these standards.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves hardcoded, plaintext AES passphrases in the securly.min.js file of the Securly Chrome Extension version 3.0.7. Detection can focus on identifying the presence of this version of the extension and inspecting the securly.min.js file for embedded plaintext AES keys.

Additionally, monitoring network traffic for unencrypted HTTP requests fetching JSON files containing crisis alert keywords and filtering rules can help detect exploitation attempts or the vulnerability in use.

• Use browser extension management commands or interfaces to verify the installed version of the Securly Chrome Extension.
• Inspect the extension files, particularly securly.min.js, for hardcoded AES keys by searching for typical AES key patterns or keywords.
• Capture network traffic using tools like tcpdump or Wireshark and filter for HTTP requests to detect unencrypted JSON file downloads related to the extension.
• Example tcpdump command to capture HTTP traffic: tcpdump -i <interface> -A 'tcp port 80 and host <target-host>'

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include removing or disabling the vulnerable version 3.0.7 of the Securly Chrome Extension to prevent exposure of hardcoded AES keys.

Ensure that any updates or patches provided by the vendor are applied promptly to replace the vulnerable extension version with a secure one.

Monitor network traffic to detect and block unencrypted HTTP requests related to the extension, enforcing HTTPS usage to protect sensitive data in transit.

Consider restricting installation of unapproved or outdated browser extensions through enterprise policies.

Useful 0 Not Useful 0