CVE-2021-33972
📋 TL;DR
CVE-2021-33972 is a buffer overflow vulnerability in Qihoo 360 Safe Browser that allows attackers to execute arbitrary code with elevated privileges. This affects users running version 13.0.2170.0 of the browser. Successful exploitation could lead to complete system compromise.
💻 Affected Systems
- Qihoo 360 Safe Browser
📦 What is this software?
Safe Browser by Browser.360
⚠️ Risk & Real-World Impact
Worst Case
Full system takeover with administrative privileges, allowing installation of persistent malware, data theft, and lateral movement across networks.
Likely Case
Local privilege escalation leading to unauthorized access to sensitive system resources and user data.
If Mitigated
Limited impact if browser runs with minimal privileges and proper security controls are in place.
🎯 Exploit Status
Exploit details and proof-of-concept code are publicly available through the provided references. Requires user interaction or initial access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 13.0.2170.0
Vendor Advisory: Not publicly documented by vendor
Restart Required: Yes
Instructions:
1. Open Qihoo 360 Safe Browser. 2. Click menu button (three horizontal lines). 3. Select 'About 360 Safe Browser'. 4. Allow browser to check for and install updates. 5. Restart browser when prompted.
🔧 Temporary Workarounds
Uninstall vulnerable version
windowsRemove the vulnerable browser version completely
Control Panel > Programs > Uninstall a program > Select '360 Safe Browser' > Uninstall
Run with limited privileges
windowsConfigure browser to run with standard user privileges instead of elevated rights
Right-click browser shortcut > Properties > Compatibility > Run this program as an administrator (uncheck)
🧯 If You Can't Patch
- Restrict browser execution through application whitelisting
- Implement strict user privilege management to limit impact of privilege escalation
🔍 How to Verify
Check if Vulnerable:
Check browser version: Open browser > Menu > About 360 Safe Browser. If version is 13.0.2170.0, system is vulnerable.Check Version:
Not applicable - check through browser GUIVerify Fix Applied:
After update, verify version is higher than 13.0.2170.0 in About dialog.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from browser executable
- Failed privilege escalation attempts in security logs
Network Indicators:
- Unusual outbound connections following browser execution
SIEM Query:
Process Creation where (Image contains '360se.exe' OR ParentImage contains '360se.exe') AND (CommandLine contains unusual parameters)🔗 References
- https://MemoryCorruptor.blogspot.com/p/vulnerabilities-disclosures.html
- https://pastebin.com/qDedtZf3
- https://www.youtube.com/channel/UCLJ6fZxUqbmPe4jiwC6o4hg/
- https://MemoryCorruptor.blogspot.com/p/vulnerabilities-disclosures.html
- https://pastebin.com/qDedtZf3
- https://www.youtube.com/channel/UCLJ6fZxUqbmPe4jiwC6o4hg/
