Skip to content
This repository has been archived by the owner on Dec 11, 2019. It is now read-only.

[Security Issue] Address Bar Spoofing #2723

Closed
jimen0 opened this issue Jul 26, 2016 · 4 comments
Closed

[Security Issue] Address Bar Spoofing #2723

jimen0 opened this issue Jul 26, 2016 · 4 comments
Assignees
@diracdeltas
Labels
QA/checked security
Milestone
0.11.2dev

Comments

@jimen0
Copy link

jimen0 commented Jul 26, 2016

Did you search for similar issues before submitting this one?
Yes
Describe the issue you encountered:
It's possible to spoof the URL that is shown in the address bar by opening a new window and writing to it using document.write.

Expected behavior:
The browser to show the real location instead of the spoofed one.

Platform (Win7, 8, 10? macOS? Linux distro?):
Ubuntu 16.04 LTS

Brave Version:

Brave: 0.11.1
Electron: 1.2.7
libchromiumcontent: 51.0.2704.103
V8: 5.1.281.65
Node.js: 6.1.0
Update Channel: dev

Steps to reproduce:
1. Place this code into an .html file in your server:

<script>
    function spoof() {
        nWindow = window.open('https:/www.google.com');
        nWindow.document.write('<body><pre>Here we could place a phising login panel</pre></body>');
}
</script>
<input type="button" onclick="spoof()" value="PoC!">
The page is being hosted in my server
  1. Open it using Brave Browser.
  2. Click the button, then the URL will be `https://www.google.com/` but the real location will be your server.

Screenshot if needed:

Result

Any related issues:
Same bug in Chrome for Android

Kind regards.
@luixxiul
Copy link
Contributor

cc: @diracdeltas

@diracdeltas diracdeltas self-assigned this Jul 26, 2016
@diracdeltas diracdeltas added this to the 0.11.3dev milestone Jul 26, 2016
@diracdeltas
Copy link
Member

repro'ed; thanks for the report. we should start a bug bounty program for issues like this.

@jimen0
Copy link
Author

jimen0 commented Jul 27, 2016

Glad that the reproduction steps were enough, @diracdeltas!
It would be an honour to be the first one who receives a reward from your BBP (:

If I may, I would recommend you to use Bugcrowd to host your BBP. Personally I use it to report vulnerabilities and is awesome.
Anyway, HackerOne, Cobalt.io and SynAck are other options to consider.

Kind regards.

@diracdeltas
Copy link
Member

i have only used hackerone as a bug reporter myself; have heard good thoughts about bugcrowd too

@luixxiul luixxiul modified the milestones: 0.11.2dev, 0.11.3dev Jul 27, 2016
This was referenced Jul 29, 2016
Closed
Closed
Closed
Closed
Closed
Closed
This was referenced Aug 2, 2016
Closed
Closed
This was referenced Aug 3, 2016
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
diracdeltas added a commit that referenced this issue Sep 10, 2016
@diracdeltas
If directly-entered URL load fails, show the location of the displaye…
670b4d4 
…d page

Fix #3851
Add regression test for #2723

Auditors: @bridiver

Test Plan:
open bankofamerica.com in a tab
put http://bayden.com/test/redir/goscript.aspx in the urlbar and hit enter
verify that the URL bar still says bankofamerica.com
@diracdeltas diracdeltas mentioned this issue Sep 10, 2016
Merged
4 tasks
@diracdeltas diracdeltas mentioned this issue Aug 2, 2018
Closed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@diracdeltas diracdeltas

Labels
QA/checked security
Projects
None yet
Milestone
0.11.2dev
Development

No branches or pull requests
4 participants
@diracdeltas @alexwykoff @luixxiul @jimen0