# CVE-2021-22929 - Brave Browser 1.27 and below permanently logs the server connection time for all v2 tor domains to ~/.config/BraveSoftware /Brave-Browser/tor/data/tor.log **URL:** \ **Category:** Write-ups and Disclosures\ **Created:** [August 16, 2021, 9:10pm UTC](https://community.disclose.io/t/cve-2021-22929-brave-browser-1-27-and-below-permanently-logs-the-server-connection-time-for-all-v2-tor-domains-to-config-bravesoftware-brave-browser-tor-data-tor-log/274 "2021-08-16T21:10:30Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![sickcodes](https://yyz2.discourse-cdn.com/flex028/user_avatar/community.disclose.io/sickcodes/32/29_2.png) [@sickcodes](https://community.disclose.io/u/sickcodes)\ **Post date:** [August 16, 2021, 9:10pm UTC](https://community.disclose.io/t/cve-2021-22929-brave-browser-1-27-and-below-permanently-logs-the-server-connection-time-for-all-v2-tor-domains-to-config-bravesoftware-brave-browser-tor-data-tor-log/274/1 "2021-08-16T21:10:30Z")
![Brave-Browser-CVE-2020-8276](https://canada1.discourse-cdn.com/flex028/uploads/disclose1/original/1X/c0ddb408a06bf3c323dc5f366fe59f33dc850dad.png) ### Title CVE-2021-22929 Brave Browser 1.27 and below permanently logs the server connection time for all v2 tor domains to ~/.config/BraveSoftware/Brave-Browser/tor/data/tor.log ### CVE ID CVE-2021-22929 ### CVSS Score Pending ### Internal ID SICK-2021-109 ### Vendor Brave ### Product Brave Browser ### Product Versions 1.27 and below ### Vulnerability Details A vulnerability in the Brave Browser v1.27 and below allows a local or physical attacker to view the exact timestamps that a user connected to a v2 onion address. A local or physical attacker could read ~/.config/BraveSoftware/Brave-Browser/tor/data/tor.log identify the exact moment a user connected to a new site, easily triangulating the user via a complete log of connection timestamps, which could be easily compared with a server connection log, a compromised Tor end point, or other related Tor attack, affecting the confidentiality & integrity of a user’s Tor session. ### Vendor Response Fixed in Brave 1.28.x [Migrate tor log from disk to memory by darkdh · Pull Request #9346 · brave/brave-core · GitHub](https://github.com/brave/brave-core/pull/9346) ### Proofs of Concept Visit [http://wikitoronionlinks.com/](http://wikitoronionlinks.com/) while using Tor Private Browsing on the Brave Browser. Click on an assortment of .onion v2 URLs. Inspect `~/.config/BraveSoftware/Brave-Browser/tor/data/tor.log` ALL v2 domains are logged at full connection time. This is actually upstream at the TOR project, however they have considered this “not a bug”. ```auto Jul 01 08:40:50.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline Jul 01 08:40:50.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline Jul 01 08:40:51.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline Jul 01 08:40:51.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline Jul 01 08:40:51.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline Jul 01 08:40:52.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline Jul 01 08:40:53.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline Jul 01 08:40:59.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline Jul 01 08:40:59.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline Jul 01 08:41:00.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline Jul 01 08:41:02.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline Jul 01 08:41:02.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline Jul 01 08:41:02.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline Jul 01 08:41:07.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline Jul 01 08:41:07.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline Jul 01 08:41:09.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline Jul 01 08:41:09.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline Jul 01 08:41:09.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline Jul 01 08:41:10.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline Jul 01 08:41:12.000 [warn] Warning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timeline ``` #### Disclosure Timeline - **2021-07-01** - Researcher discovers vulnerability - **2021-07-07** - Vendor patches vulnerability - **2021-08-16** - 1.28 released & report disclosed on HackerOne ### Links [https://github.com/brave/brave-core/pull/9346](https://github.com/brave/brave-core/pull/9346) [https://hackerone.com/reports/1249056](https://hackerone.com/reports/1249056) [https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-109.md](https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-109.md) [https://sick.codes/sick-2021-109](https://sick.codes/sick-2021-109) ### Researchers Sick Codes: [https://github.com/sickcodes](https://github.com/sickcodes) || [https://twitter.com/sickcodes](https://twitter.com/sickcodes) #### CVE Links [https://sick.codes/sick-2021-109](https://sick.codes/sick-2021-109) [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22929](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22929) [https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-22929](https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-22929) ---
**Author:** ![sickcodes](https://yyz2.discourse-cdn.com/flex028/user_avatar/community.disclose.io/sickcodes/32/29_2.png) [@sickcodes](https://community.disclose.io/u/sickcodes)\ **Post date:** [August 17, 2021, 5:56pm UTC](https://community.disclose.io/t/cve-2021-22929-brave-browser-1-27-and-below-permanently-logs-the-server-connection-time-for-all-v2-tor-domains-to-config-bravesoftware-brave-browser-tor-data-tor-log/274/2 "2021-08-17T17:56:34Z")
> **[Brave Logs the Server Connection Time for All v2 Tor Domains](https://www.privacyaffairs.com/cve-2021-22929-brave-tor-vulnerability/)** > > Cybersecurity researcher Sick.Codes discovered vulnerability on Brave 1.27 and below where the browser logs the server connection time for all v2 tor domains. “Sick.Codes explained to Privacy Affairs during a phone interview that he also notified Tor of this issue but Tor did not consider this to be a major problem.” " In September 2020 Tor announced that it wold be deprecating v2 onion addresses. Beginning June 2021 the Tor browser started warning users about this change whenever they access a v2 domain. Users receive warnings any number of times they access a new v2 domain even during the same browsing session." “The Brave browser versions 1.27 and below logged these events in the _~/.config/BraveSoftware/Brave-Browser/tor/data/tor.log_ file.” “Because the Brave log timestamps coincide with the server connection time (as it’s when the warning is displayed), an attacker could determine the identity of the user if physical access of a device is obtained.”