CVE-2025-0443
Overview
Changed Functions
| Function | Change | Notes |
|---|---|---|
iffront_end/models/extensions/ExtensionAPI.ts |
modified |
Files Changed
front_end/models/extensions/ExtensionAPI.ts
Patch
From b50c1dbc6b709196064bb26ee75b1ed6cee4f974 Mon Sep 17 00:00:00 2001 From: Danil Somsikov <[email protected]> Date: Mon, 04 Nov 2024 12:09:10 +0000 Subject: [PATCH] Protect canAccessResource in DevTools API form prototype pollution Bug: 376625003 Change-Id: Ib07a65da8f342c4727bceb6afcbd920bcfd07b81 Reviewed-on: https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/5987430 Reviewed-by: Philip Pfaffe <[email protected]> Commit-Queue: Danil Somsikov <[email protected]> --- diff --git a/front_end/models/extensions/ExtensionAPI.ts b/front_end/models/extensions/ExtensionAPI.ts index 54afa52..a346408 100644 --- a/front_end/models/extensions/ExtensionAPI.ts +++ b/front_end/models/extensions/ExtensionAPI.ts @@ -1146,9 +1146,17 @@ }, }; + const protocolGet = Object.getOwnPropertyDescriptor(URL.prototype, 'protocol')?.get; + function getProtocol(url: string): string { + if (!protocolGet) { + throw new Error('URL.protocol is not available'); + } + return protocolGet.call(new URL(url)); + } + function canAccessResource(resource: APIImpl.ResourceData): boolean { try { - return extensionInfo.allowFileAccess || (new URL(resource.url)).protocol !== 'file:'; + return extensionInfo.allowFileAccess || getProtocol(resource.url) !== 'file:'; } catch (e) { return false; }
Original Bug Report
Local file access restrictions in chrome.devtools can be bypassed through prototype manipulation.
Steps to reproduce the problem
- Install the attached extension on macOS, and disable “Allow access to file URLs”.
- Open devtools on the new tab opened by the extension.
- Edit the /etc/hosts file highlighted in the sources panel, and save the changes.
- Observe that extension pops up an alert with the new contents of this file.
Problem Description
Various APIs under chrome.devtools use the canAccessResource function (https://chromium.googlesource.com/devtools/devtools-frontend/+/refs/heads/main/front_end/models/extensions/ExtensionAPI.ts#1149) for checking if local resources should be accessible to a given extension. However, the checks in this function can currently be entirely bypassed by overriding URL.prototype’s protocol getter as is done in the attached POC. Since there are no additional checks on the ExtensionServer side when adding event listeners through chrome.devtools.inspectedWindow.onResourceContentCommitted.addListener, an extension can gain access to local resources this way if the user interacts with such resources in the sources panel.
Additional Comments
Previous issues relating to this include:
- https://issues.chromium.org/issues/40060465
- https://issues.chromium.org/issues/40063505 Notably, the latter of those was fixed by https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/4370246, which in turn introduced the possibility to modify the URL prototype to bypass this check.
Summary
Local file access restrictions in chrome.devtools can be bypassed through prototype manipulation.
Additional Data
Category: Security
Chrome Channel: Stable
Regression: N/A