2

I've just discovered this:

  • You can create IFRAME pointing to "chrome-extension://" protocol
  • You can access IFRAME content with jQuery

Does this mean, I'm able to use badly written Chrome Extensions to exploit user workspace?

by

  • accessing extension files directly (sqlite db with passwords,...)
  • using chrome.extension.sendRequest call to interact with foreign extensions

to for example forcing stubleupon extension to like my page, without user confirming/creating the action?

Is this security issue or not?

Improve this question
6
  • 1
    I was looking into this not long ago, but I came to the conclusion that you couldn't access the IFRAME's contents. Do you mind sharing how this is done?
    – cobbal
    Oct 27, 2011 at 8:38
  • $('#iframeID').contents() api.jquery.com/contents
    – Marek Sebera
    Oct 27, 2011 at 8:40
  • When doing that I get the following error: Unsafe JavaScript attempt to access frame with URL chrome-extension://gkndfifopckmhdkohjeoljlbfnjhekfg/data/ui/popup.html from frame with URL http://example.com/drop/1684e00170648ceaf597b52380c2243a510b5b3a.html. Domains, protocols and ports must match.
    – cobbal
    Oct 27, 2011 at 8:45
  • Oh, my mistake. This method works outside of Google Chrome, so this is going to be closed as false ... Sorry
    – Marek Sebera
    Oct 27, 2011 at 9:07
  • 1
    @MarekSebera, I suggest that you post your conclusion as a short answer and accept it. I am pretty sure that there are other people out there, who make the same wrong assumption. So having an short explanation that there is no vulnerability because of the same origin check is helpful.
    – Hendrik Brummermann
    Oct 27, 2011 at 14:54

2 Answers 2

Reset to default
3

Ok, so we came up with conclusion that this is not vulnerability
Although we have a way how to access IFRAME contents with $("selector").contents();
and although we can really point IFRAMEs to chrome-extension:// protocol

The point is, we cannot use this in Google Chrome only (till now)
Thanks to Google Chrome Javascript security implementation, we have to respect

Same Origin Policy (SOP)
described here: http://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy_for_DOM_access

We cannot access DOM content loaded from other origin in the same session

Attack possibilities

It's still possible vulnerability, but with need of disabling SOP on google chrome
can be done like this:

chromium-browser --disable-web-security

but it is quite difficult to do it from within web browser ;-)

taken from here: https://stackoverflow.com/questions/3102819/chrome-disable-same-origin-policy

Improve this answer
1

Krzysztof Kotowicz recently published a framework for exploiting vulnerabilities in Google Chrome extensions : XSS ChEF.

He described it in detail in his blog : http://blog.kotowicz.net/2012/07/xss-chef-chrome-extension-exploitation.html

Improve this answer
1
  • 1
    Yes. However, it's worth mentioning that his framework is only applicable if the Chrome Extension contains a security vulnerability (e.g., a XSS vulnerability). Thus, as far as I can tell, his work seems to be unrelated to what this question is asking about. Or, maybe I misunderstood the question and this is relevant after all.
    – D.W.
    Nov 1, 2012 at 0:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.