3

I am working on web application security auditing. I was going through various checklists & methodology.

I found one interesting stuff in a document.

Type - Configuration Management Security Testing - After logout, I created a dump file of my chrome browser and opened it in winhex editor. Used search feature of that tool and inserted "pass =" in order to find password. I found username and password shown in hex with that tool.

My question - Is it a vulnerability of an application?

I was also seeking for a solution. I thought if a developer could reset the variable after immediate login, it can eliminate this vulnerability. Am I right ?

| improve this question | |
1

Is it a vulnerability? Yes.

Is it a severe vulnerability? Probably not. For an attacker to read a password out of memory, they need some way to read arbitrary parts of memory, either by running their own program on the computer (in which case security is already totally compromised) or by exploiting a use-after-free or similar bug to convince another program to do the reading for them.

As for a solution, it depends on where the password is coming from. If it's Javascript, there's no surefire way to solve it: Chrome doesn't know there's anything special about the variable so it can't wipe it after use, and the Javascript can't count on successive writes to the variable ending up in the same piece of memory.

| improve this answer | |
  • well it will be on stored in heap and heap is not that predictable and if u have a UAF then there are better things to do than reading a random chunk of memory. point is u can't predict location of password in memory 1) It will be on heap ,heap is not perdictable 2) ASLR – FrOgY May 1 '14 at 9:14
1

When you find it in the memory of the web browser, the information was leaked by the web browser, not the web application. You can not make the web application you are auditing responsible for Chrome doing insecure stuff.

Also, to access that information, someone would need access to the users private computer and have permission to run diagnostic tools. When the attacker got that far, they could also install a keylogger to obtain the users password. That's also an attack vector which a web application can hardly do anything against, so it should be out of scope for a security audit of a web application.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.