Security: chrome-devtools protocol allows to read the content of C:\ drive via watchExpression
Reported by
chromium...@gmail.com,
Nov 15 2016
|
||||||
Issue descriptionVERSION Chrome Version: 54.0.2840.99 m Operating System: Windows 7 REPRODUCTION CASE 1. Navigate to the link below. 2. Open Developer tools. 3. Switch to Sources panel >> Click on Watch >> observe. To repro this on 56.0.2920.0 canary (64-bit) you should navigate to chrome-devtools://devtools/remote/serve_rev/@199588/devtools.html (before the step-1).
,
Nov 18 2016
Not sure if I'm missing anything, but the code in the attachment throws a syntax error for me. dgozman, could you please triage? Thanks.
,
Nov 18 2016
,
Nov 29 2016
Unless I'm missing something here, it seems like you need to click the "Watch" button for this to work? Assigning low since that seems like an unlikely attack scenario.
,
Nov 29 2016
Can't repro this after fixing Issue 653134 .
,
Nov 29 2016
Ok, thanks for confirming!
,
Mar 8 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by elawrence@chromium.org
, Nov 15 2016Components: Platform>DevTools