Home

Awesome

<div align="center" >🤝 Show your support - give a ⭐️ if you liked the content | <a target="_blank" href='https://twitter.com/intent/tweet?url=https://github.com/Puliczek/CVE-2022-0337-PoC-Google-Chrome-Microsoft-Edge-Opera&text=CVE-2022-0337%20System%20environment%20variables%20leak%20on%20Google%20Chrome,%20Microsoft%20Edge%20and%20Opera&via=pulik_io'>SHARE on Twitter</a> | Follow me on <a target="_blank" href='https://twitter.com/pulik_io'><img src='https://img.shields.io/badge/Twitter-%231DA1F2.svg?&style=flat&logo=twitter&logoColor=white'/></a> <a target="_blank" href='https://www.youtube.com/channel/UCaAdOBH2hnqLvEri1M7eg5Q'><img src='https://img.shields.io/badge/YouTube-%23FF0000.svg?&style=flat&logo=youtube&logoColor=white'/></a> </div>

CVE-2022-0337 System environment variables leak on Google Chrome, Microsoft Edge and Opera

📝 Description

Successful exploitation of this vulnerability can lead to the leak of user's secrets stored inside a system environment variables. A security bug was found in Chromium 92 version and patched in 97 version. There are several web browsers based on the chromium engine, for instance, Google Chrome, Microsoft Edge, Opera, and Brave. All of them were vulnerable, except for Brave. The vulnerability is in the File system access API, more specifically in window.showSaveFilePicker() method.


CVE Version: CVE-2022-0337

Credits: Maciej Pulikowski

Reward: $10,000 from Google VRP


Web browser versions vulnerability:

ChromeEdgeOperaFirefoxBrave
92-96 Vulnerable ❗️❗️ <br> 97+ Patched (safe) ✔92-96 Vulnerable ❗️❗️<br>97+ Patched (safe) ✔78-82 Vulnerable ❗️❗️<br>82 Patched (safe) ✔Safe ✔Safe ✔

Check your web-browser version:

Operation Systems:

ONLY WINDOWS are vulnerable. Linux and Mac are safe.

📺 Youtube Proof of Concept

https://www.youtube.com/watch?v=q7OIEWtalg8

PoC Video

Thanks for the thumbs up and subscriptions 😀👍

👨‍💻 Code Proof of concept

The simplest one

proof of concept gif

  1. Write in your Devtools:
let a = await window.showSaveFilePicker({suggestedName:'%username%'});
a.name;
  1. Save file
  2. Your username should appear

In the example, it is used a %username% environment variable. It returns Windows username logged in. Moreover, there are much more interesting environment variables:

Here are some examples:

and many more...

So the attacker could gain an access to targets AWS services, Github account or Binance token to API (withdraw money) and more...

Check out more secrets in environment variables on my repository:

🦄🔒 Awesome list of secrets in environment variables 🖥️

🦄🔒 Awesome list of secrets in environment variables 🖥️


Crafted HTML with improvlments

The previous example is run in local Google Chrome Devtools.

Obviously, the attacker could craft a special HTML file (website) to do successful exploitation of this vulnerability.

env.html - is an example of crafted special HTML in the repository.

But, do really user is required to download a file?

Yes, however, the attacker can create a website to encourage User to hold ENTER button on keyboard for 2 seconds to run and accept saving file dialog. Because windows dialog by default focus Save button, file will be saved with only blink.

env example on website (1) *.gif is from Opera (Chrome and Edge were already fixed)

In conclusion, user after holding the ENTER button on keyboard for 2 seconds could lead to leak of his system environments variables. This is a significant problem because user could store important secrets in system environments variable ex. Access to his AWS services, Github account or Binance

🧠 Things to remember from the write-up:

🔨 Fix in chromium

I gave myself challange to repair the bug. Here, I would like to underline that I am not a c++ dev 😎.

source: https://bugs.chromium.org/p/chromium/issues/detail?id=1247389#c9

One of solution was to just replace character % in suggestedName to _ . It should solve the problem.

My solution:

image

could be insert in:

https://source.chromium.org/chromium/chromium/src/+/main:content/browser/file_system_access/file_system_chooser.cc;l=238?q=ResolveSuggestedNameExtension&ss=chromium%2Fchromium%2Fsrc

and the results are:

Before fix:

image

After my fix:

image

Indeed it solved the problem, but it wasn't the best place to insert the code 😋 . However, I was very happy to manage to repair it by myself 😎

Final fix can be found here:

https://bugs.chromium.org/p/chromium/issues/detail?id=1247389#c12

🌌 Timeline

💻 Useful links

🤝 Show your support

<div>🤝 Show your support - give a ⭐️ if you liked the content | <a target="_blank" href='https://twitter.com/intent/tweet?url=https://github.com/Puliczek/CVE-2022-0337-PoC-Google-Chrome-Microsoft-Edge-Opera&text=CVE-2022-0337%20System%20environment%20variables%20leak%20on%20Google%20Chrome,%20Microsoft%20Edge%20and%20Opera&via=pulik_io'>SHARE on Twitter</a> | Follow me on <a target="_blank" href='https://twitter.com/pulik_io'><img src='https://img.shields.io/badge/Twitter-%231DA1F2.svg?&style=flat&logo=twitter&logoColor=white'/></a> <a target="_blank" href='https://www.youtube.com/channel/UCaAdOBH2hnqLvEri1M7eg5Q'><img src='https://img.shields.io/badge/YouTube-%23FF0000.svg?&style=flat&logo=youtube&logoColor=white'/></a> </div> <br>

✔️ Disclaimer

This project can only be used for educational purposes. Using this software against target systems without prior permission is illegal, and any damages from misuse of this software will not be the responsibility of the author.