In GNOME Shell through 45.2, unauthenticated remote code execution can be achieved by intercepting two DNS requests (GNOME Network Manager and GNOME Shell Portal Helper connectivity checks), and responding with attacker-specific IP addresses. This DNS hijacking causes GNOME Captive Portal to be launched via a WebKitGTK browser, by default, on the victim system; this can run JavaScript code inside a sandbox. NOTE: the vendor's position is that this is not a vulnerability because running JavaScript code inside a sandbox is the intended behavior. References: https://gitlab.gnome.org/GNOME/gnome-shell/-/blob/ceed3e07e44f2cd1bfdbf273523abc0bb4bbd8c1/js/portalHelper/main.js https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/7666
Created gnome-shell tracking bugs for this issue: Affects: fedora-all [bug 2283555]
This vulnerability is classified as moderate severity rather than high because it requires a specific and controlled environment to be exploited effectively. The attacker needs to perform DNS hijacking within the same local network, which limits the scope of potential targets. Additionally, the exploit depends on the GNOME Captive Portal automatically opening a WebKitGTK browser, which, while a default behavior, may not be universally applicable across all GNOME configurations. Furthermore, modern web browsers use sandboxing as a mechanism to contain malicious activity, significantly reducing the potential impact of the exploit. This sandboxing mitigates the risk of the attack affecting other parts of the system, thus lowering the severity of this flaw to moderate. The exploitation vector, while technically feasible, involves multiple steps that reduce the likelihood of widespread, automated attacks. Thus, the impact, while serious, is confined to scenarios with network control and specific GNOME settings, justifying its moderate severity classification.
My understanding is that this issue was fixed in gnome-shell 47+ with [1], which we have in Fedora 41 and newer, therefore this issue can be closed. [1] - https://gitlab.gnome.org/GNOME/gnome-shell/-/commit/4ab1ccf3f21b754ce4be77becf5df46084a893d8
I'm sorry, I accidentally closed the tracker instead of the Fedora bug. Reopening again.