New issue
Advanced search Search tips

Issue 824531 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner: ----
Closed: Mar 2018
Cc:
EstimatedDays: ----
NextAction: ----
OS: iOS
Pri: 1
Type: Bug-Security



Sign in to add a comment

Security: Redirected URL leak on iOS

Reported by chromium...@gmail.com, Mar 21 2018

Issue description

VERSION
Chrome Version: 66.0.3359.30
Operating System: iOS

REPRODUCTION CASE
1. Load https://attack.shhnjk.com/get_resource.html
2. Observer 

The alert is shown with "shhnjk.com/?secrect".

 
screen.jpeg
33.9 KB View Download
Labels: OS-iOS
The problem here is that PerformanceAPI's ResourceTiming exposes the post-redirection URL of a cross-origin resource.

The POC does not seem to reproduce in Safari 11.0.3 or Safari Tech Preview 11.2, yielding the script error

TypeError: undefined is not an object (evaluating 'performance.getEntriesByType("resource")[1].name')
(anonymous function) — get_resource.html:3
Selected Element
<body>…</body>

Is the POC supposed to be looking at element 0 instead of element 1?

  performance.getEntriesByType("resource")[0].name

Comment 3 by cthomp@chromium.org, Mar 21 2018

Components: Blink>PerformanceAPIs>ResourceTiming
Labels: Security_Severity-Medium Security_Impact-Beta
Owner: ricea@chromium.org
Status: Assigned (was: Unconfirmed)
Marking this as Medium severity as it is leaking cross-origin history, although in a particularly limited capacity (which might make an argument for Low severity).

Adding component Blink>PerformanceAPIs>ResourceTiming per #2.

I was unable to reproduce this on Chrome Dev M67 on iOS.

ricea@: Could you take a look or help find an owner? Thanks.
cthomp@ Are you able to repro this on Canary?

Comment 5 by ricea@chromium.org, Mar 22 2018

Cc: ios-bugs@chromium.org
Components: -Blink>PerformanceAPIs>ResourceTiming
Owner: ----
Status: Untriaged (was: Assigned)
The Blink component isn't right because iOS doesn't use Blink. I don't know what component to use for iOS, so I have CC:d ios-bugs@chromium.org.
Project Member

Comment 6 by sheriffbot@chromium.org, Mar 22 2018

Labels: M-66
Project Member

Comment 7 by sheriffbot@chromium.org, Mar 22 2018

Labels: ReleaseBlock-Stable
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 8 by sheriffbot@chromium.org, Mar 22 2018

Labels: Pri-1
Cc: danyao@google.com
Reporter: What version of iOS were you able to reproduce this on? I couldn't reproduce this issue in Desktop Safari or Safari TechPreview, which may mean that this is limited to outdated versions of WebKit on outdated iOS.

In terms of Severity, this should indeed be Medium; see  Issue 799847  for an equivalent case.

I'm not sure if assigning a security bug to an alias works correctly. 

If we can reproduce this, we need to add our Apple friends and set status to ExternalDependency.


re c#9, 11.2.2 iOS 

Note: Firefox also has this bug.
I tested Chrome 67.0.3368.0 on iOS 11.2.6. This might mean that a point release along the way included a WebKit fix that stops this.

Comment 12 by danyao@google.com, Mar 22 2018

I was able to reproduce the bug in iOS simulator with iOS 11.2, but not iOS 11.3. The results is same between Safari and Chrome. So I think WebKit must have shipped a fix.
Status: Fixed (was: Untriaged)
Thanks for helping check that. I'll mark this as Fixed then.
Project Member

Comment 14 by sheriffbot@chromium.org, Mar 24 2018

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Labels: reward-topanel
Labels: -ReleaseBlock-Stable
Labels: -reward-topanel reward-NA
Thanks for the report! I'm afraid I'm marking as reward-na since no fix was made in response.
Project Member

Comment 18 by sheriffbot@chromium.org, Apr 27 2018

Labels: Merge-Request-67
Project Member

Comment 19 by sheriffbot@chromium.org, Apr 27 2018

Labels: -Merge-Request-67 Merge-Review-67 Hotlist-Merge-Review
This bug requires manual review: Less than 28 days to go before AppStore submit on M67
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), kbleicher@(ChromeOS), govind@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: -Hotlist-Merge-Review -Merge-Review-67
Per comment #12 and the fact that there's no cl attached to this bug, I'm removing merge-request.
Components: Mobile>WebView>Glue
Labels: -M-66
Project Member

Comment 22 by sheriffbot@chromium.org, Jun 29 2018

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment