Security: Chrome injects HTML autofill username and password when username is a specific string
Reported by
tdib...@gmail.com,
Sep 15
|
||
Issue descriptionVULNERABILITY DETAILS Chrome saved autofill username and password is unexpectedly/unwantedly injected into an HTML form when the username is exactly the string "Nick". I have tested and reproduced this behavior on two different computers and user accounts on an edit account form on a website. The HTML form does not contain any HTML autocomplete attributes or any non-standard behavior. <input type="text" name="f[username]" value="Nick" placeholder="Enter username" id="f_username"> <input type="password" name="f[password]" placeholder="(unchanged)" id="f_password"> In more detail: I login with my own credentials to a CMS backend for a website that manages multiple user accounts. I edit a user page which contains HTML username and password fields for that user (not myself), but my own saved Chrome autofill data gets injected into the form fields --- but only if the username is Nick! Not Nicky, not Nickie, not any other string, just "Nick". Is this an Easter egg? Do you have a developer who's coded in his own name for testing purposes and forgotten it? In any case, this can compromise saved username and password data in Chrome or lead to compromising user mistakes. VERSION Chrome version: 69.0.3497.92 Operating System: Windows 10 latest up-to-date (15th Sep 2018) REPRODUCTION CASE Unfortunately I cannot attach an HTML file as this requires authenticating to a website with saved Chrome credentials and then accessing an HTML form where the existing username field value is "Nick". It will be easier for you to reproduce on an existing system of your choice. FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION Type of crash: n/a Crash State: n/a Client ID (if relevant): n/a
,
Sep 16
Thanks. In the specific case where this was noticed, it was possible that the autofill data would be saved onto another user's record inside a content-management system, whereby the edited user would inherit the username and password from the authenticated user (admin). If username/password data were then viewable in plaintext anywhere to the edited user, they would gain access to admin credentials --- only because of Chrome.
,
Sep 17
cfroussios is working on a non-hardcoded version of this that should fix your concerns. This in active development but we don't have an ETA, yet. |
||
►
Sign in to add a comment |
||
Comment 1 by rsesek@chromium.org
, Sep 16Labels: -Type-Bug-Security -Restrict-View-SecurityTeam OS-Chrome OS-Linux OS-Mac OS-Windows Pri-2 Type-Bug
Owner: ioanap@chromium.org
Status: Assigned (was: Unconfirmed)