Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports without the security team.

Overview: A logic flaw in the Network Service allows a compromised renderer to bypass forbidden HTTP method checks by sending a TRACE request in kNoCors mode. This causes cross-origin SameSite=None cookies to be reflected back in the response body, which is not blocked by Opaque Response Blocking (ORB), leading to cross-origin data exfiltration.

Affected files:

• services/network/cors/cors_url_loader_factory.cc
• services/network/orb/orb_impl.cc
• services/network/public/cpp/cors/cors.cc
• services/network/orb/orb_mimetypes.cc

Estimated timestamp from git blame: 2022-02-08

Summary

A compromised renderer process can potentially exfiltrate cross-origin SameSite=None and HttpOnly cookies from any target origin that has the HTTP TRACE method enabled. This is possible due to a gap between CORS validation and Opaque Response Blocking (ORB) in the Network Service. Specifically, CorsURLLoaderFactory allows the TRACE method for requests marked with kNoCors mode, and ORB defaults to failing-open for the resulting message/http reflected response.

Vulnerability Details

1. CORS Method Validation Bypass

In Blink, the Fetch API explicitly forbids methods like TRACE (third_party/blink/renderer/core/fetch/request.cc). However, a compromised renderer can bypass Blink’s checks by directly constructing and sending a network::ResourceRequest via the network::mojom::URLLoaderFactory Mojo interface.

When the Network Service receives this request, CorsURLLoaderFactory::IsValidRequest validates it. While it normally blocks forbidden methods, there is an exception for kNoCors mode:

// services/network/cors/cors_url_loader_factory.cc:913
if ((request.mode != mojom::RequestMode::kNoCors &&
     cors::IsForbiddenMethod(request.method)) ||
    (request.mode == mojom::RequestMode::kNoCors &&
     base::EqualsCaseInsensitiveASCII(
         request.method, net::HttpRequestHeaders::kConnectMethod))) {
  mojo::ReportBadMessage("CorsURLLoaderFactory: Forbidden method");
  return false;
}

By setting request.mode = kNoCors, the attacker bypasses the IsForbiddenMethod check. TRACE is allowed through, and because it is kNoCors, no CORS preflight is required.

2. Credential Attachment and TRACE Reflection

If the attacker also sets request.credentials_mode = kInclude, the network stack attaches the target cross-origin server’s SameSite=None cookies to the outgoing TRACE request. (Note: SameSite=Lax/Strict cookies are protected because the request is cross-site).

The HTTP TRACE method specification requires the server to echo the received request back to the client, typically with a Content-Type: message/http. This means the SameSite=None cookies are reflected in the response body.

3. ORB Fail-Open for message/http

Because the request is a cross-origin kNoCors request, the response is routed through Opaque Response Blocking (ORB).

1. MIME Type: ORB categorizes message/http as MimeType::kOthers.
2. Sniffing: The response body starts with the reflected request line (e.g., "TRACE / HTTP/1.1"). This does not match the blocklisted signatures for HTML, XML, or JSON, causing Sniff to return Decision::kSniffMore.
3. Fail-Open Decision: Once sniffing concludes, OpaqueResponseBlockingAnalyzer::HandleEndOfSniffableResponseBody defaults to a fail-open state, returning Decision::kAllow.

Because ORB allows the response, the original Mojo data pipe containing the full response body (with the reflected cookies) is forwarded back to the compromised renderer, allowing the attacker to read them.

Potential Reproduction Steps

Note: These are suggested steps for a proof-of-concept, as our analysis is based on static code review.

1. From a compromised renderer process, obtain a network::mojom::URLLoaderFactory remote (e.g., the default subresource loader factory).
2. Call CreateLoaderAndStart with a network::ResourceRequest configured as follows:
   • url: https://target-with-trace-enabled.com/
   • method: TRACE
   • mode: kNoCors
   • credentials_mode: kInclude
3. Capture the response using a network::mojom::URLLoaderClient.
4. Read the raw response data pipe to extract the reflected request headers, including the victim’s cross-origin cookies.

Recommended Fix

Update CorsURLLoaderFactory::IsValidRequest to block all forbidden methods regardless of the RequestMode. The exception for kNoCors is unnecessary since the web platform (Fetch/XHR) does not allow TRACE or TRACK to be used even in no-cors mode.

if (cors::IsForbiddenMethod(request.method) ||
    base::EqualsCaseInsensitiveASCII(
         request.method, net::HttpRequestHeaders::kConnectMethod)) {
  mojo::ReportBadMessage("CorsURLLoaderFactory: Forbidden method");
  return false;
}

Evaluated with Chrome root at commit: ff3d2b74fa39431785bd60e51463b08fcc71ee33

Results so far have been promising, but there can be wrong deductions. If this proves to be a false positive, please close as WAI; data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.