Issue metadata
Sign in to add a comment
|
Auto Download file on chrome linux version
Reported by
m.as...@isecur1ty.org,
Sep 3 2016
|
||||||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/49.0.2623.108 Chrome/49.0.2623.108 Safari/537.36 Steps to reproduce the problem: 1. 2. 3. What is the expected behavior? What went wrong? we can download a default "download" file into the Downloads directory , without user interaction by playing with the MIME types through the data function. So the hacker can download a malware into the client machine without his permission and execute it later with serveral techniques like Social Engineering or any technical issuse like a normal executable file that runs our malware. on our case , we successfully downloaded a bash script that could bind a command shell on the user machine and waiting for any connection. Did this work before? Yes Chrome version: 49.0.2623.108 Channel: n/a OS Version: Flash Version: This bug could be very good assistant to any hacker to accomplish a full successfully attack on the user machine. The bug also works with android versions , but not confirmed on any windows versions.
,
Sep 3 2016
,
Sep 3 2016
Thanks for reporting this issue. The file is downloaded with the name "download" (no extension). This is working as intended. We do not expect the malicious actors to be able to convince and guide the users into changing the file extensions of files on disk. It is doable, but we consider the user interaction needed here fairly non-trivial.
,
Sep 3 2016
but the attackers still can execute the downloaded file even if they can't change the file extensions , and this is the theory , download the "download" file into the user machine , and later we can execute it without even change the file extensions as i said.
,
Dec 10 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Mar 10 2017
For all Download Protection VRP bugs: removing label Restrict-View-Google and adding Restrict-View-SecurityTeam instead.
,
Mar 10 2017
Removing the Restrict-View-SecurityTeam label since this isn't a security bug and was open before. |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by m.as...@isecur1ty.org
, Sep 3 2016