Incomplete fix of issue 853937
Reported by
s.h.h.n....@gmail.com,
Jul 16
|
|||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36 Steps to reproduce the problem: 1. Enable #service-worker-payment-apps and #just-in-time-service-worker-payment-app flags 2. Go to https://shhnjk.azurewebsites.net/pay_handler.html 3. Hold Enter key for 3 seconds 4. Observe that attacker gets XSS capability in test.shhnjk.com What is the expected behavior? Payment App installation fails. What went wrong? Issue 853937 is address by checking that payment method manifest and web app manifest are a same-site. That easy because we are assuming that attacker can already upload JSON looking file. So attacker just needs to upload another file. But what would be difficult is, attacker needs to point that payment method manifest in response header. Luckily, it turns out that same-siteness is only checked with initial URL. There for, if victim site has an open redirect anywhere in same-site as manifest location, attacker gets XSS again. Did this work before? N/A Chrome version: 69 Channel: dev OS Version: OS X 10.13.3 Flash Version:
,
Jul 17
This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it. If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security_Impact or Security_Severity labels, and remove the ReleaseBlock label. To disable this altogether, apply ReleaseBlock-NA. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jul 17
Great catch, didn't notice open redirect. I will fix it by only allow same site redirects, https://chromium-review.googlesource.com/c/chromium/src/+/1141046
,
Jul 18
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/a46ca4b0445c425471244980ea98b9e721f4aea5 commit a46ca4b0445c425471244980ea98b9e721f4aea5 Author: gogerald <gogerald@google.com> Date: Wed Jul 18 13:56:35 2018 [Payments] Prevent cross site redirects for payment method HEAD Bug: 863974 Change-Id: Idfeae3e29ff93b0897e822035d2f35282b6c8ca1 Reviewed-on: https://chromium-review.googlesource.com/1141046 Commit-Queue: Ganggui Tang <gogerald@chromium.org> Reviewed-by: Mathieu Perreault <mathp@chromium.org> Cr-Commit-Position: refs/heads/master@{#576026} [modify] https://crrev.com/a46ca4b0445c425471244980ea98b9e721f4aea5/components/payments/core/payment_manifest_downloader.cc [modify] https://crrev.com/a46ca4b0445c425471244980ea98b9e721f4aea5/components/payments/core/payment_manifest_downloader_unittest.cc
,
Jul 18
close this bug as it has been fixed as above, feel free to reopen it if necessary
,
Jul 19
,
Jul 23
,
Aug 6
*** Boilerplate reminders! *** Please do NOT publicly disclose details until a fix has been released to all our users. Early public disclosure may cancel the provisional reward. Also, please be considerate about disclosure when the bug affects a core library that may be used by other products. Please do NOT share this information with third parties who are not directly involved in fixing the bug. Doing so may cancel the provisional reward. Please be honest if you have already disclosed anything publicly or to third parties. Lastly, we understand that some of you are not interested in money. We offer the option to donate your reward to an eligible charity. If you prefer this option, let us know and we will also match your donation - subject to our discretion. Any rewards that are unclaimed after 12 months will be donated to a charity of our choosing. *********************************
,
Aug 6
Thanks for this! The VRP panel decided to award $3,000 for this report, and a $133.70 bonus for the diligence to verify the previous fix.
,
Aug 6
Great! Finally I’m an elite :)
,
Aug 6
,
Aug 16
,
Oct 25
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||
►
Sign in to add a comment |
|||||||||
Comment 1 by est...@chromium.org
, Jul 16Labels: -Pri-2 M-69 Security_Impact-Head Security_Severity-Medium OS-Android OS-Chrome OS-Linux OS-Windows Pri-1
Owner: gogerald@chromium.org
Status: Assigned (was: Unconfirmed)