Open Selenium Web Driver Module

[smcintyre-r7]

If there is an open selenium web driver, a remote attacker can send requests to the victims browser. In certain cases this can be used to set command line flags for the browser which can sometimes be used for command injection. When command injection fails, the local file system can still be accessed using the file:// URI.

If the command injection can be tested and confirmed in cases, that would make for a nice exploit module. Access to the remote file system could be a separate, auxiliary module.

References:

• https://www.wiz.io/blog/seleniumgreed-cryptomining-exploit-attack-flow-remediation-steps
• https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/
• https://www.exploit-db.com/exploits/49915