VULNERABILITY DETAILS
cross site frame count leak

This bug describes a SOP bypass much similar to https://bugzilla.mozilla.org/show_bug.cgi?id=1315203
but does not use the .history.length but instead a ref to either iframe.contentWindow.length or ref to a window.length

The length of a reference to a iframe or window object contains the number of frames on the remote page and can be polled to deduce state.

Applications are vulnerable if the same url or a redirected url returns a different number of frames depending on victims state. This can by used by an attacker to make bi-directional CSRF and other similar issues to XSHM.

 - https://www.owasp.org/index.php/Cross_Site_History_Manipulation_(XSHM)
 - https://www.netsparker.com/blog/web-security/bruteforce-wordpress-local-networks-xshm-attack/

If the target has a x-frame-options policy the window object reference methods must be used. 
Without the policy that attack can be run much more subtle inside a iframe. 

No POC provided for the second iframe vector, it is almost the same, with document.querySelector("iframe").length

For reproduction I added a POC similar to https://bugzilla.mozilla.org/show_bug.cgi?id=1315203 reproducing the "Am I logged into Facebook?". The POC is not for displaying another fingerprinting method, but just to show that the length can be used to infere much the same as xshm. Another more complicated POC could be bi-directional CSRF login attack, intranet weak credentials checking etc. 


VERSION
Chrome Version: 58.0.3029.110 (64-bit)
Operating System: Ubuntu 16.04 

REPRODUCTION CASE
# window object (example at http://159.203.190.123/00100010-poc-2aovnht7sqmxjfg28f87fnisjfpnlfzzyxufne.html)

- poc tested on desktop pc

<p class="status">
  Click on the page. This text will update
</p>
<script>
  var t = "https://www.facebook.com/messages/"
  var s = document.querySelector(".status")

  window.addEventListener("click", (e) => {
    e.preventDefault()
    l = window.open(t);
    alert("Pull back focus. Press OK and wait 4 seconds");
    setInterval( () => {
      if(l.length > 1) {
        s.innerText = "You are logged into Facebook"
      } else {
        s.innerText = "You are not logged into Facebook"
      }
      l.location.href = t
    }, 4000)
  });
</script>