🎩 🤟🏻 [P1-$10,000] Google Chrome, Microsoft Edge and Opera - vulnerability reported by Maciej Pulikowski - System environment variables leak - CVE-2022-0337
Successful exploitation of this vulnerability can lead to the leak of user's secrets stored inside a system environment variables. A security bug was found in Chromium 92 version and patched in 97 version. There are several web browsers based on the chromium engine, for instance, Google Chrome, Microsoft Edge, Opera, and Brave. All of them were vulnerable, except for Brave. The vulnerability is in the File system access API, more specifically in window.showSaveFilePicker() method.
CVE Version: CVE-2022-0337
Credits: Maciej Pulikowski
Reward: $10,000 from Google VRP
92-96 Vulnerable ❗️❗️ 97+ Patched (safe) ✔ |
92-96 Vulnerable ❗️❗️ 97+ Patched (safe) ✔ |
78-82 Vulnerable ❗️❗️ 82 Patched (safe) ✔ |
Safe ✔ | Safe ✔ |
Check your web-browser version:
chrome://version/
edge://version/
opera://update
ONLY WINDOWS are vulnerable. Linux and Mac are safe.
https://www.youtube.com/watch?v=q7OIEWtalg8
Thanks for the thumbs up and subscriptions 😀👍
let a = await window.showSaveFilePicker({suggestedName:'%username%'});
a.name;
In the example, it is used a %username% environment variable. It returns Windows username logged in. Moreover, there are much more interesting environment variables:
Here are some examples:
and many more...
So the attacker could gain an access to targets AWS services, Github account or Binance token to API (withdraw money) and more...
Check out more secrets in environment variables on my repository:
🦄🔒 Awesome list of secrets in environment variables 🖥️
The previous example is run in local Google Chrome Devtools.
Obviously, the attacker could craft a special HTML file (website) to do successful exploitation of this vulnerability.
env.html - is an example of crafted special HTML in the repository.
But, do really user is required to download a file?
Yes, however, the attacker can create a website to encourage User to hold ENTER button on keyboard for 2 seconds to run and accept saving file dialog. Because windows dialog by default focus Save button, file will be saved with only blink.
*.gif is from Opera (Chrome and Edge were already fixed)
In conclusion, user after holding the ENTER button on keyboard for 2 seconds could lead to leak of his system environments variables. This is a significant problem because user could store important secrets in system environments variable ex. Access to his AWS services, Github account or Binance
I gave myself challange to repair the bug. Here, I would like to underline that I am not a c++ dev 😎.
source: https://bugs.chromium.org/p/chromium/issues/detail?id=1247389#c9
One of solution was to just replace character % in suggestedName to _ . It should solve the problem.
could be insert in:
and the results are:
Indeed it solved the problem, but it wasn't the best place to insert the code 😋 . However, I was very happy to manage to repair it by myself 😎
Final fix can be found here:
https://bugs.chromium.org/p/chromium/issues/detail?id=1247389#c12
This project can only be used for educational purposes. Using this software against target systems without prior permission is illegal, and any damages from misuse of this software will not be the responsibility of the author.