Issue metadata
Sign in to add a comment
|
Security: fullscreen notification can be overlapped by 401 basic unauthorized dialog
Reported by
zxyrz...@gmail.com,
Aug 4
|
||||||||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.84 Safari/537.36 Steps to reproduce the problem: 1. open http://test.au1ge.xyz/401.html 2. click start What is the expected behavior? 401 unauthorized dialog should kick out fullscreen What went wrong? By adding an iframe with 401 unauthorized page, fullscreen notification can be overlapped, which lead to UI spoof Did this work before? N/A Chrome version: 68.0.3440.84 Channel: stable OS Version: OS X 10.13.6 Flash Version: Shockwave Flash 30.0 r0
,
Aug 6
Any one to handle this issue?
,
Aug 6
I've tried entering some data into the spoofing dialog and it looks like that data was passed to google.com, i.e. I've been redirected to https://www.google.com/?account=asd&password=a&email=a&submit=Submit&gws_rd=ssl Could you add that dialog on top of google.com page, but actually submit the form to some other server?
,
Aug 6
OKļ¼the dialog is a step to finish the attack, and the real bug is fullscreen notification can be overlapped, it's easy to steal the victim's input, I just need to add an event listener on formSubmit and make an AJAX request, I will attach the attack code, and already updated the online demo, after you fill out the dialog, you can open http://test.au1ge.xyz/pw.txt to see your input
,
Aug 6
Thank you for providing more feedback. Adding the requester to the cc list. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Aug 7
Nice, thanks for the updated PoC! kenrb@, I've seen some other spoofing issues assigned to you. Could you please take a look at this one?
,
Aug 7
,
Aug 7
,
Aug 7
,
Aug 7
This is identical to issue 817809 , which was duped into issue 812769 , so presumably this should be similarly duped.
,
Dec 5
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by zxyrz...@gmail.com
, Aug 4