Report description

Site Isolation bypass leading to Arbitrary File Write through RenderFrameHost, Extension Installation, and Downloads Page.

Bug location

Where do you want to report your vulnerability?

Chrome VRP – Report security issues affecting the Chrome browser. See program rules

Which URL (or repository) have you found the vulnerability in?

content/browser

The problem

Please describe the technical details of the vulnerability

(Note from the security team: POC was originally provided as a link and is now elided)

Arbitrary navigation in subframe

We have found a new vulnerability in the NavigationURLLoaderImpl component that allows us to commit and request urls of the devtools: origin. A recent change in how NavigationURLLoaderImpl processes redirect checks, specifically in how it handles bypass_redirect_checks in the URLResponseHead allows us to redirect to a URL with a devtools: scheme. The redirect checks rely on source site instance, and that can be blocked out due to how RenderFrameProxyHost registers the initiator frame token (as this is optional). Providing a renderer hosted Blob that has a custom Load() implmentation allows for the redirect to happen to arbritary schemes with no checks.

Bisect Info: Introduced in https://chromium-review.googlesource.com/c/chromium/src/+/6692491 Affecting stable, beta, and canary as of right now. Introduced bypass_redirect_checks in the mojo structure through an enabled-by-default flag.

Error Page Isolation failure in blocked subframes

When the subframe is blocked by the request, the error page commits in the original process. However, before the navigation commits, the browser process grants us the ability to commit to the error’ed url (devtools://devtools/bundled/inspector.html in this case) and since being able to commit a URL also means we are able to request that url as long as it belongs to the origin devtools://devtools, we are able to use this to navigate to a sandboxed process. In the past, this wouldn’t be able to allow us to commit new schemes, but now we are able to so we are able to arbitrarily navigate. To force error page isolation failure, we set a CSP to block the request after the NavigationRequest::commit_params().url gets updated, and used in the RenderFrameHostImpl::FailedNavigation state.

Bisect Info: https://chromium-review.googlesource.com/c/chromium/src/+/1115203 This introduced the vulnerability as error page isolation is only enabled for main frames here.

devtools://devtools/bundled/inspector.html UXSS

Effectively what happens is InspectorFrontendHost grants us the ability to set the injected script for any origin. When an iframe is embedded within the page, we are able to inject the script of our choosing, and it will execute.

Bisect Info: https://chromium-review.googlesource.com/c/chromium/src/+/533701 introduced the ability to inject scripts from the browser process.

Enabled Drag From Downloads Page to Chrome://Extensions installDroppedFile()

Downloads pages are able to start a drag for any download item. This means, we can start a download from any page which doesn’t require user interaction, Using the UXSS we have on the chrome://downloads page, by using downloads.mojom.PageHandler.drag method in the frame, we can open the extensions page, start a drag on that page and then run installDroppedFile() immediately since WebContents captures drop data if the drag is entered at all. This leads to arbitrary extension installation.

BisectInfo: This vulnerability was introduced when installDroppedFile was introduced which was from this crrev https://chromium-review.googlesource.com/c/chromium/src/+/981119 back in 2018.

Perfetto UI

Perfetto UI’s extension ID is impersonated in this exploit by using the manifest.json “key” property from zip installation. A chrome debugger session is created with the browser, this is then used to send a tab creation request, and inject chrome devtools protocol bindings into that tab. This is used to then create a new target from there, and this is further detailed in the perfetto_extension.zip attachment. The message Input.dispatchDragEvent was used to upload and read arbritary files on the file system, and is better than DOM.setFIleInputFiles as it allows for directory entries to be read and manipulated. File read is demonstrated by catting /etc/lsb-release onto the screen. File write is demonstrated through Page.setDownloadBehavior and you can check for the file under /tmp/pwned-{time}.

To reproduce, extract the files, and run python3 srver.py 3020. The port MUST be 3020. Your service also needs to support [host].localhost domains. If you don’t have support for this, feel free to reach out. However, the underlying requirement is that it is necessary to have two domains that are cross-site from each other. (not just cross-origin as it turns out) to carry out the attack.

Renderer Patches

The patches, which are exclusively renderer-side, are used to remove origin checks, and add extension renderer bindings. These are purely renderer side and are necessary to carry out the attack. In order for the renderer patches to be useful, the attacker site will need to bypass site isolation, so the patches are not granting new capabilities aside from what would have been reached with a compromised renderer. This is other than automatically granting user activation to any popups from open(), although this is still acheivable with renderer RCE eitherway.

How to run the PoC: execute the patched chrome binary with the flags –enable-blink-features=MojoJS –user-data-dir=/tmp The instructions for starting the web server are located in the zip file. (it is a large zip file)

Feel free to ask any questions.

Impact analysis

Attackers with a compromised renderer can use this to escape the sandbox, read arbritary files to steal information, write arbitrary files (in this case I chose /tmp/pwned-{time}) and execute code on the machine by writing to auto-start locations or bashrc.

The cause

What version of Chrome have you found the security issue in?

stable+latest

Is the security issue related to a crash?

No, it is not related to a crash.

Choose the type of vulnerability

Site Isolation Bypass

How would you like to be publicly acknowledged for your report?

Avadhut Mahamuni