Issue metadata
Sign in to add a comment
|
Security: cross-origin content download using redirect from server
Reported by
vladimir...@gmail.com,
Jun 23 2018
|
||||||||||||||||||||||||
Issue description# Security: cross-origin downloading using server redirect includes cookies VULNERABILITY DETAILS It's possible to download cross-origin content using redirect from server (browser includes cookies in this case). Downloading of cross-origin pages disallowed in Chrome, when the link points directly to another html page. However, browser sends cookies with a cross-origin download redirect. Downloaded content could include sensitive content (gmail example in PoC). 1. Download cross-origin pages 2. Download cross-origin cookie-protected content VERSION Chrome Version: 67.0.3396.87 stable Operating System: macOS 10.13.5 17F77 x86_64 REPRODUCTION CASE 1. node ./server.js (npm install serve-handler) 2. visit localhost:3333 3. Click "Download gmail WITH redirect" - (link points to https://localhost:3333/fake_same_origin/https://mail.google.com/mail/u/0/) 4. Server redirects - to https://mail.google.com/mail/u/0/ 5. Page downloads as a file - html of https://mail.google.com/mail/u/0/ 6. If you're logged in to Gmail, then downloaded files includes emails. Screencast attached.
,
Jun 25 2018
,
Jun 25 2018
The downloaded page doesn't resolve completely with 301 status, only with 302/303/307/308. With 301 - downloaded file size is ~42kb for gmail (but still includes sensitive info) With 302/303/307/308 - downloaded file size is ~1200kb for gmail Also, this behavior is reproducible with Ctrl+click on a link without redirect, but it behaves similarly to redirecting with 301
,
Jun 27 2018
Not sure why this was labelled a PDF bug. Did I miss something? I'll pick creis@ for this cross-origin bug.
,
Jun 27 2018
I believe Jochen implemented the changes to <a download>. I don't know off the top of my head what we intend to allow and what we intend to block, but I suspect he will know. :)
,
Jun 27 2018
,
Oct 3
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by och...@chromium.org
, Jun 25 2018Components: Internals>Network>Cookies Internals>Plugins>PDF
Labels: Security_Severity-Low Security_Impact-Stable
Owner: thestig@chromium.org
Status: Assigned (was: Unconfirmed)