Bug: Unauthorized File Exfiltration via Cross-Origin PostMessage
Status: RESOLVED
Priority: --
Resolution: INVALID
Created: 2024-07-28 19:38:43+00:00
Resolved: 2024-08-06 18:28:27+00:00

version tested: 128.0 (64-bit)

# Summary
This vulnerability demonstrates how an attacker can exfiltrate local file content from a user's system to an external server using a combination of the File API and cross-origin communication via the postMessage API. The attacker tricks the user into selecting a file from their system through a seemingly benign interface. Once the file is selected, its content is read using the File API. The read content is then sent to an embedded iframe on the attacker's domain using postMessage. 
The iframe, which runs on a different origin, receives the file content and forwards it to the attacker's server using a standard HTTP request. This attack leverages the browser's handling of cross-origin messages and file reads, bypassing the same-origin policy that is supposed to protect against such data exfiltration. Despite the presence of CORS errors indicating blocked responses, the actual data transfer to the attacker's server succeeds, highlighting a significant security gap in handling cross-origin data exchanges. 
This method allows the attacker to access and steal sensitive information without the user's knowledge or explicit consent, posing a serious security risk.

# Steps to reproduce


 1. Set Up Node.js or any other HTTPS Server


 2. Main Page (index.html):
Create an HTML page that includes a file input element and a button to trigger the file exfiltration.

When the button is clicked, read the selected file's content using the File API (FileReader).

Send the file content to an iframe using the postMessage API.

3. Iframe Page (iframe.html):
 
Host this HTML page on the attacker's domain.

Configure the iframe to listen for messages from the main page.

When the message containing the file content is received, log the data and send it to an external server (e.g., using a webhook URL) via an HTTP POST request.

4. Start the Node.js HTTPS Server:
    Run the HTTPS server script to start serving the main page.

5. Access the Web Page:
 Open a browser and navigate to the URL of the main page served by the local HTTPS server.

6. Testing:
 Select a file using the file input on the main page.
 
Click the button to trigger the file exfiltration.

Observe the console logs for file content on both the main page and the iframe.

Check the webhook URL to verify that the file content has been exfiltrated.



# Behind the Scenes Explanation:

1. Setting Up the Environment:
The Node.js server is configured to allow cross-origin requests from the attacker's domain using CORS headers.

The server serves the main page, which contains the file input and logic to handle file reading and message passing.

2. File Selection and Reading:
The user selects a file from their local system using the file input on the main page.

When the user clicks the button, the main page reads the content of the selected file using the File API (FileReader).

3. Cross-Origin Communication:

The main page uses the postMessage API to send the file content to an embedded iframe hosted on the attacker's domain.
 
The iframe listens for messages from the main page and logs the received file content.

4. Data Exfiltration:
Upon receiving the file content, the iframe sends the data to an external server using an HTTP POST request.

The external server (e.g., a webhook URL) logs or processes the exfiltrated data.

5. Observing the Results:
Despite CORS errors shown in the browser console, indicating blocked responses, the actual data transfer to the external server succeeds.

The browser enforces CORS policies by blocking access to the response but does not prevent the request from being sent, allowing the data exfiltration to occur.


# Findings:

During the testing, it was observed that the browser's console showed CORS-related errors:

Origin https://cyborjime.000webhostapp.com is not allowed by Access-Control-Allow-Origin. Status code: 200

Fetch API cannot load https://webhook.site/e5f99eb2-709c-4f15-9cdd-471e60dd95ee due to access control checks.

Failed to exfiltrate data: TypeError: Load failed

Despite these errors, the file content was successfully received at the webhook URL. This indicates that while the browser's security model enforces CORS policies and blocks the response from being read by the frontend JavaScript, the actual request with the data was still sent to the server. The server processes the incoming data and responds, but the browser does not allow the JavaScript to access the response.

#The Scenario

1. File Selection and Reading: A user selects a file, and its content is read using the File API.
2. Cross-Origin Communication: The file content is transferred to an iframe hosted on a different domain using postMessage.
3. Data Transmission: The iframe attempts to send the file content to a webhook URL using the Fetch API
4. CORS Bypass: Despite CORS errors, the file content is successfully received by the webhook server.                                            

# Impact:
This vulnerability can lead to unauthorized access to and exfiltration of sensitive files from a user's system. An attacker can trick a user into selecting a sensitive file, and the content of that file can be sent to an external server without the user's knowledge or consent.

Unauthorized Data Transfer: Sensitive file content can be exfiltrated without the user's knowledge or permission.

Privacy Breach: This can lead to exposure of confidential information, such as financial data, personal documents, or intellectual property.


#Mitigations

Stricter CORS Policies: Ensure that both preflight (OPTIONS) and actual requests are strictly validated against CORS policies, preventing the data from being sent if the origin is not allowed.

Mandatory Preflight Requests: Ensure that preflight OPTIONS requests are always sent before actual data transfer.

Blocked Responses: Prevent JavaScript from accessing responses if CORS checks fail.

Data Type Validation:
Limit the type of data that can be transferred via postMessage to prevent file content transmission.

Event Listener Security: Implement stricter checks on message event listeners to prevent unauthorized access.