Skip to content

Latest commit

 

History

History
164 lines (101 loc) · 9.3 KB

README.md

File metadata and controls

164 lines (101 loc) · 9.3 KB
Raw
🤝 Show your support - give a ⭐️ if you liked the content | SHARE on Twitter | Follow me on

CVE-2022-0337 System environment variables leak on Google Chrome, Microsoft Edge and Opera

📝 Description

Successful exploitation of this vulnerability can lead to the leak of user's secrets stored inside a system environment variables. A security bug was found in Chromium 92 version and patched in 97 version. There are several web browsers based on the chromium engine, for instance, Google Chrome, Microsoft Edge, Opera, and Brave. All of them were vulnerable, except for Brave. The vulnerability is in the File system access API, more specifically in window.showSaveFilePicker() method.

CVE Version: CVE-2022-0337

Credits: Maciej Pulikowski

Reward: $10,000 from Google VRP

Web browser versions vulnerability:

Chrome Edge Opera Firefox Brave
92-96 Vulnerable ❗️❗️
97+ Patched (safe) ✔		 92-96 Vulnerable ❗️❗️
97+ Patched (safe) ✔		 78-82 Vulnerable ❗️❗️
82 Patched (safe) ✔		 Safe ✔ Safe ✔

Check your web-browser version:

  • Google Chrome: chrome://version/
  • Microsoft Edge: edge://version/
  • Opera: opera://update

Operation Systems:

ONLY WINDOWS are vulnerable. Linux and Mac are safe.

📺 Youtube Proof of Concept

https://www.youtube.com/watch?v=q7OIEWtalg8

PoC Video

Thanks for the thumbs up and subscriptions 😀👍

👨‍💻 Code Proof of concept

The simplest one

proof of concept gif

  1. Write in your Devtools:
let a = await window.showSaveFilePicker({suggestedName:'%username%'});
a.name;
  1. Save file
  2. Your username should appear

In the example, it is used a %username% environment variable. It returns Windows username logged in. Moreover, there are much more interesting environment variables:

Here are some examples:

  • AWS_SECRET_ACCESS_KEY
  • AZURE_CLIENT_SECRET
  • binance_secret
  • GITHUB_TOKEN
  • GOOGLE_API_KEY

and many more...

So the attacker could gain an access to targets AWS services, Github account or Binance token to API (withdraw money) and more...

Check out more secrets in environment variables on my repository:

🦄🔒 Awesome list of secrets in environment variables 🖥️

🦄🔒 Awesome list of secrets in environment variables 🖥️

Crafted HTML with improvlments

The previous example is run in local Google Chrome Devtools.

Obviously, the attacker could craft a special HTML file (website) to do successful exploitation of this vulnerability.

env.html - is an example of crafted special HTML in the repository.

But, do really user is required to download a file?

Yes, however, the attacker can create a website to encourage User to hold ENTER button on keyboard for 2 seconds to run and accept saving file dialog. Because windows dialog by default focus Save button, file will be saved with only blink.

env example on website (1) *.gif is from Opera (Chrome and Edge were already fixed)

In conclusion, user after holding the ENTER button on keyboard for 2 seconds could lead to leak of his system environments variables. This is a significant problem because user could store important secrets in system environments variable ex. Access to his AWS services, Github account or Binance

🧠 Things to remember from the write-up:

  • Environments variables can store secrets ex. tokens, api-key, secrets
  • if payload "%USERNAME%" or "$:USERNAME" or "${USERNAME}" or "$USER" return real username then target is vulnerable

🔨 Fix in chromium

I gave myself challange to repair the bug. Here, I would like to underline that I am not a c++ dev 😎.

source: https://bugs.chromium.org/p/chromium/issues/detail?id=1247389#c9

One of solution was to just replace character % in suggestedName to _ . It should solve the problem.

My solution:

image

could be insert in:

https://source.chromium.org/chromium/chromium/src/+/main:content/browser/file_system_access/file_system_chooser.cc;l=238?q=ResolveSuggestedNameExtension&ss=chromium%2Fchromium%2Fsrc

and the results are:

Before fix:

image

After my fix:

image

Indeed it solved the problem, but it wasn't the best place to insert the code 😋 . However, I was very happy to manage to repair it by myself 😎

Final fix can be found here:

https://bugs.chromium.org/p/chromium/issues/detail?id=1247389#c12

🌌 Timeline

  • [07.09.2021, 10:40 PM GMT+2] Bug reported by Maciej Pulikowski
  • [07.09.2021, 11:36 PM GMT+2] Bug accepted (Pri:1, Severity-High)
  • [08.11.2021, 1:30 AM GMT+1] My submit for possible fix in code for chromium source
  • [10.12.2021, 6:09 PM GMT+1] Fixed
  • [7.01.2022, 2:09 AM GMT+1] Reward of $10,000
  • [18.03.2022, 6:30 PM GMT+1] Google removed security view restrictions

💻 Useful links

🤝 Show your support

🤝 Show your support - give a ⭐️ if you liked the content | SHARE on Twitter | Follow me on

✔️ Disclaimer

This project can only be used for educational purposes. Using this software against target systems without prior permission is illegal, and any damages from misuse of this software will not be the responsibility of the author.