Security: Chrome does not distinguish between http and https proxies when saving passwords |
||||||||||
Issue descriptionVULNERABILITY DETAILS In login_handler.cc, passwords meant for HTTP proxy authentication are associated with the authority "http://" + host-port-of-server when constructing a PasswordForm for saving passwords. This is done regardless of whether the proxy is using https or http. Consequently, if a user has saved passwords for an https proxy, then a malicious operator could present the same host+port combination as an http proxy and get Chrome to autofill the credentials. A mitigating factor is that both the https proxy and the fake http proxy both need to use the same HTTP authentication scheme. (Forking off from issue 613626 ) VERSION Chrome Version: 49+ Operating System: Win, Mac, Linux, ChromeOS, Android REPRODUCTION CASE - Setup an https proxy that requires HTTP basic authentication. - Use the proxy with Chrome and save the password when prompted. - Setup a http proxy with the same host and port and which uses HTTP basic authentication. - Attempting to use the http proxy results in an HTTP proxy auth dialog that's autofilled with the credentials for the https proxy.
,
Jun 16 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/098c009df7a4ddc5c23d4d3c9dccf5eff1f24c98 commit 098c009df7a4ddc5c23d4d3c9dccf5eff1f24c98 Author: asanka <asanka@chromium.org> Date: Thu Jun 16 20:18:43 2016 Use correct origin when prompting for proxy authentication. Since M49, Chrome has been prompting for proxy authentication credentials using the target origin instead of the origin of the proxy server. Even if the proxy origin was displayed correctly, a mischievous network operator could still spoof the proxy server origin. To mitigate these problems, this CL: * Fixes the origin used in the proxy authentication login prompt to use the origin of the proxy server. * Indicate if the proxy server connection is insecure. * Always throw up an interstitial and clear the omnibox when showing a proxy auth prompt. * Use the correct origin when saving proxy authentication credentials. BUG= 613626 , 620737 Review-Url: https://codereview.chromium.org/2067933002 Cr-Commit-Position: refs/heads/master@{#400247} [modify] https://crrev.com/098c009df7a4ddc5c23d4d3c9dccf5eff1f24c98/chrome/browser/ui/login/login_handler.cc [modify] https://crrev.com/098c009df7a4ddc5c23d4d3c9dccf5eff1f24c98/chrome/browser/ui/login/login_handler.h [modify] https://crrev.com/098c009df7a4ddc5c23d4d3c9dccf5eff1f24c98/chrome/browser/ui/login/login_handler_unittest.cc [modify] https://crrev.com/098c009df7a4ddc5c23d4d3c9dccf5eff1f24c98/content/shell/browser/shell_login_dialog.cc [modify] https://crrev.com/098c009df7a4ddc5c23d4d3c9dccf5eff1f24c98/net/base/auth.cc [modify] https://crrev.com/098c009df7a4ddc5c23d4d3c9dccf5eff1f24c98/net/base/auth.h [modify] https://crrev.com/098c009df7a4ddc5c23d4d3c9dccf5eff1f24c98/net/http/http_auth_controller.cc [modify] https://crrev.com/098c009df7a4ddc5c23d4d3c9dccf5eff1f24c98/net/http/http_network_transaction_unittest.cc [modify] https://crrev.com/098c009df7a4ddc5c23d4d3c9dccf5eff1f24c98/net/url_request/url_request_ftp_job.cc
,
Jun 16 2016
,
Jun 17 2016
Adding Merge-Triage label for tracking purposes. Once your fix had sufficient bake time (on canary, dev as appropriate), please nominate your fix for merge by adding the Merge-Request-XX label, where XX is the Chrome milestone. When your merge is approved by the release manager, please start merging with higher milestone label first. Make sure to re-request merge for every milestone in the label list. You can get branch information on omahaproxy.appspot.com. - Your friendly ClusterFuzz
,
Jun 17 2016
,
Jun 20 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/8c8b7cc66aa395a12b7a25f59d9cd4d1eb71f1a4 commit 8c8b7cc66aa395a12b7a25f59d9cd4d1eb71f1a4 Author: Asanka Herath <asanka@chromium.org> Date: Mon Jun 20 14:53:42 2016 [Merge M52] Use correct origin when prompting for proxy authentication. Since M49, Chrome has been prompting for proxy authentication credentials using the target origin instead of the origin of the proxy server. Even if the proxy origin was displayed correctly, a mischievous network operator could still spoof the proxy server origin. To mitigate these problems, this CL: * Fixes the origin used in the proxy authentication login prompt to use the origin of the proxy server. * Indicate if the proxy server connection is insecure. * Always throw up an interstitial and clear the omnibox when showing a proxy auth prompt. * Use the correct origin when saving proxy authentication credentials. BUG= 613626 , 620737 Review-Url: https://codereview.chromium.org/2067933002 Cr-Commit-Position: refs/heads/master@{#400247} (cherry picked from commit 098c009df7a4ddc5c23d4d3c9dccf5eff1f24c98) Review URL: https://codereview.chromium.org/2082513003 . Cr-Commit-Position: refs/branch-heads/2743@{#397} Cr-Branched-From: 2b3ae3b8090361f8af5a611712fc1a5ab2de53cb-refs/heads/master@{#394939} [modify] https://crrev.com/8c8b7cc66aa395a12b7a25f59d9cd4d1eb71f1a4/chrome/browser/ui/login/login_handler.cc [modify] https://crrev.com/8c8b7cc66aa395a12b7a25f59d9cd4d1eb71f1a4/chrome/browser/ui/login/login_handler.h [modify] https://crrev.com/8c8b7cc66aa395a12b7a25f59d9cd4d1eb71f1a4/chrome/browser/ui/login/login_handler_unittest.cc [modify] https://crrev.com/8c8b7cc66aa395a12b7a25f59d9cd4d1eb71f1a4/content/shell/browser/shell_login_dialog.cc [modify] https://crrev.com/8c8b7cc66aa395a12b7a25f59d9cd4d1eb71f1a4/net/base/auth.cc [modify] https://crrev.com/8c8b7cc66aa395a12b7a25f59d9cd4d1eb71f1a4/net/base/auth.h [modify] https://crrev.com/8c8b7cc66aa395a12b7a25f59d9cd4d1eb71f1a4/net/http/http_auth_controller.cc [modify] https://crrev.com/8c8b7cc66aa395a12b7a25f59d9cd4d1eb71f1a4/net/http/http_network_transaction_unittest.cc [modify] https://crrev.com/8c8b7cc66aa395a12b7a25f59d9cd4d1eb71f1a4/net/url_request/url_request_ftp_job.cc
,
Jul 8 2016
,
Jul 19 2016
,
Sep 23 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 1 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 2 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 2 2016
,
Nov 29
|
||||||||||
►
Sign in to add a comment |
||||||||||
Comment 1 by rsleevi@chromium.org
, Jun 16 2016