BROWSER-OTHER -- Snort has detected suspicious traffic known to exploit vulnerabilities present in an Internet browser other than Firefox, Internet Explorer, or Chrome, or which is present in multiple browsers. This rule should be enabled for systems that use any mainstream browser, to offer complete coverage. (ie, If a vulnerability affects both Chrome and Firefox, but is covered by a rule under the Chrome category, Firefox users might have Chrome coverage turned off and miss the vulnerability.)
BROWSER-OTHER Electron nodeIntegration bypass exploit attempt
This event is generated when an attempt to exploit CVE-2018-1000136, an Electron nodeIntegration bypass, over file transport protocols is detected.
An attacker who successfully exploits CVE-2018-1000136 could achieve arbitrary code execution in the context of the current user where the Electron-based application is being run.
Ease of Attack:
A proof-of-concept exploit for this vulnerability has been published.
What To Look For
No public information
No known false positives
Cisco Talos Intelligence Group
MITRE ATT&CK Framework
For reference, see the MITRE ATT&CK vulnerability types here:
CVE Additional Information
CVE-2018-1000136Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node integration AND has not specified if webview is enabled/disabled. This vulnerability appears to have been fixed in 1.7.13, 1.8.4, 2.0.0-beta.4.
||Ease of Access||