Medium severity · published Feb 23, 2021
CVE-2021-21323
Brave is an open source web browser with a focus on privacy and security
5.3
CVSS
2.3%
EPSS
No
On KEV
Description
Brave is an open source web browser with a focus on privacy and security. In Brave versions 1.17.73-1.20.103, the CNAME adblocking feature added in Brave 1.17.73 accidentally initiated DNS requests that bypassed the Brave Tor proxy. Users with adblocking enabled would leak DNS requests from Tor windows to their DNS provider. (DNS requests that were not initiated by CNAME adblocking would go through Tor as expected.) This is fixed in Brave version 1.20.108
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BR
Brave · Brave
1.17.73 through 1.20.103 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-21323
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-21323
Patch
https://github.com/brave/brave-browser/issues/13527
Third Party Advisory
https://github.com/brave/brave-browser/security/advisories/GHSA-mqjf-9x5g-2rv6
Patch
https://github.com/brave/brave-core/commit/12fe321eaad8acc1cbd1d70b4128f687777bcf15
Patch
https://github.com/brave/brave-core/pull/7769
Permissions Required
https://hackerone.com/reports/1077022
More from Brave
7.5
CVE-2021-45884
In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requests are issued…
6.5
CVE-2022-47934
Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file that mentions an ipfs:// or ipns:// URL
6.5
CVE-2022-47933
Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme
6.5
CVE-2022-47932
Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:// or ipns:// URL
6.5
CVE-2018-10799
A hang issue was discovered in Brave before 0.14.0 (on, for example, Linux)