Issue metadata
Sign in to add a comment
|
Local files disclosure via webkitdirectory
Reported by
0x0a1...@gmail.com,
Nov 8 2017
|
||||||||||||||||||||||
Issue descriptionSummary: Using the webkitdirectory alongside minor user interaction, we are able to grab OS username of a victim. This is because the webkitdirectory object is not properly sanitized after a folder has been picked. In my case, the downloads folder was the default folder to select and so I ended up with 'Abdulrahman/Downloads' Products affected: Version 62.0.3202.75 (Official Build) (64-bit) OS Platform: Microsoft Windows Steps To Reproduce: Open attached PoC and hold 'enter' for a bit.
,
Nov 8 2017
yes.
,
Nov 8 2017
This is a duplicate of bug 637098 which already is public: http://leucosite.com/Chrome-Firefox-Edge-Local-File-Disclosure/
,
Nov 8 2017
but still this is work
,
Nov 8 2017
0x0a1337: Yes, the bug still works, but it was previously reported in bug 637098 . You can follow the progress on that bug, thanks.
,
Feb 24 2018
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by elawrence@chromium.org
, Nov 8 2017Summary: Local files disclosure via webkitdirectory (was: local files disclosure)