VULNERABILITY DETAILS
If DevTools is open, then a script [1] is run in the context of the webpage. The script has some cases of `__proto__: null`, presumably to prevent accessors on `Object.prototype` from messing with the objects in there. However, the assignment `InjectedScript.primitiveTypes = ...` *is* interceptable, and the entire `InjectedScript` function is thereby leaked to the webpage.

Of particular interest is the `InjectedScript.RemoteObject.prototype._generatePreview` function. This calls the native function `InjectedScriptHost.getInternalProperties`. Its return value can be intercepted by overwriting `_appendPropertyDescriptors`. What is interesting is that the return value contains `Scope` objects. These are objects that map variable names to objects that are in scope of a given function. This can be used to obtain non-exposed variables in a script.

In particular, using some tricks it is possible to run a function that requires a user gesture without a user gesture, like I did in  issue 468931 . (That issue has been fixed, but using this vulnerability that particular exploit can still be done if DevTools is open.)

The details: Using `getInternalProperties`, we can get `Event` in `webstore_custom_bindings.js`, a script used in the extension system but run for regular webpages. In turn, we can get `$Function` since it is in scope of `Event` in `event.js`. Overwriting `$Function.bind`, we can intercept a function defined in `bindings.js`. That function has `require` in scope, which can be used to obtain `getFileBindingsForApi` in `file_entry_binding_util.js`. This function has `GetModuleSystem` in scope, which can be used to obtain `requireNative`. Finally, this can be used to obtain `RunWithGesture` in the `guest_view_internal` native module.

VERSION
Chrome Version: 55.0.2881.5 canary (64-bit). It does not reproduce in stable. I did not try beta/dev.
Operating System: Windows 10

REPRODUCTION CASE
See attachment. It is a bit dirty so as to trigger certain codepaths. Note that it only reproduces when DevTools is open.

 [1] https://chromium.googlesource.com/v8/v8/+/master/src/inspector/injected-script-source.js

 

Deleted: bug.html 2.1 KB

bug.html 2.1 KB View Download