Stealing PDF content by changing renderer's security_origin_
Reported by
jun.koka...@microsoft.com,
Dec 15
|
|||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 Steps to reproduce the problem: 1. Go to https://tt.shhnjk.com/steal_pdf.html 2. Open Windbg and attach to that process 3. Download spoof.js attached and run ".scriptrun C:\windbg\spoof.js" 4. Click "Go" button on the Web Page What is the expected behavior? PDF content of www.apple.com should be leaked to tt.shhnjk.com What went wrong? PDF Script API allows postMessages from Javascript. To avoid information leakage, it checks if message source's origin is same as PDF's. Unfortunately, security_origin_ in renderer process can be modified once renderer process is compromised. This is not a big deal right now since there's no Site Isolation applied to PDF processes. But this bug should be tracked as part of issue 786673 Did this work before? N/A Chrome version: 71.0.3578.98 Channel: stable OS Version: 10.0 Flash Version:
,
Dec 16
Passing over to Site isolation folks to further decide who should own this/whether it should be a separate security bug or is already tracked by site isolation. Assigning it security medium tentatively.
,
Dec 17
,
Dec 17
+tsepez@ who AFAIR worked on PDF isolation I have trouble identifying where "checks if message source's origin is same as PDF's" are happening. I don't see such checks in OutOfProcessInstance::HandleMessage (where getSelectedTextReply is sent in response to kJSGetSelectedTextType). I also don't see an explicit origin field in the PpapiHostMsg_PPBInstance_PostMessage IPC (which AFAIU is sent directly from the rendererer which embeds the plugin into the plugin host process). FWIW, I believe a similar bug might be present in window.postMessage (I've opened issue 915721 to track this).
,
Dec 17
Given that it is known that Site Isolation doesn't yet protect against compromised renderers, I think this should be tracked as a regular, non-security bug and/or feature work. What do you all think?
,
Dec 17
>I have trouble identifying where "checks if message source's origin is same as PDF's" are happening. Following is the check. https://cs.chromium.org/chromium/src/chrome/browser/resources/pdf/pdf_viewer.js?q=getSelectedTextReply&sq=package:chromium&g=0&l=856
,
Dec 27
,
Jan 3
Give lack of responses to #c5 above, let me open this bug up.
,
Jan 3
,
Jan 3
Even though this is not a security *bug* (but rather part of feature work for Site Isolation enforcements), I think that we should still consider this bug for VRP, given that we were not aware of these particular gaps.
,
Jan 3
|
|||||||||
►
Sign in to add a comment |
|||||||||
Comment 1 by jun.koka...@microsoft.com
, Dec 15522 bytes
522 bytes View Download