Penetration Test Report (Cure53): pentest report metamask

Dr.-Ing. Mario Heiderich, Cure53
Rudolf Reusch Str. 33
D 10367 Berlin
cure53.de · mario@cure53.de
Pentest-Report MetaMask 08.2017
Cure53, Dr.-Ing. M. Heiderich, Dipl.-Ing. A. Inführ, N. Kobeissi, T.-C. Hong, M. Kinugawa
Index
Introduction
Scope
Identified Vulnerabilities
MM-01-002 Extension: Phishing Detector can be bypassed (Medium)
MM-01-003 Extension: Unsafe Background Script Communications (Info)
MM-01-005 Web: Missing Clickjacking protection on MetaMascara (Info)
MM-01-006 Extension: Potentially buggy random ID assignment (Low)
Miscellaneous Issues
MM-01-001 Extension: External Links not using HTTPS (Info)
MM-01-004 Extension: Improper MIME-type check in Web3 injection (Info)
Conclusions
Introduction
“MetaMask is a bridge that allows you to visit the distributed web of tomorrow in your
browser today. It allows you to run Ethereum dApps right in your browser without
running a full Ethereum node.
MetaMask includes a secure identity vault, providing a user interface to manage your
identities on different sites and sign blockchain transactions.”
From https://metamask.io/
This report documents the findings of the Cure53 assessment of the MetaMask project.
Specifically in scope was the MetaMask browser extension and its variation running from
a ServiceWorker. Five members of the Cure53 team were involved in completing the
assignment which took place over the course of six days in August 2017 and yielded six
security-relevant findings.
With the premise of the scope encompassing both a browser extension and a
considerable number of JavaScript files, the logical approach to follow was to rely on the
white-box methodology. Consequently, the Cure53 testers were granted access to all
relevant sources via GitHub repository. Notably, the tested software is open source, so
the available public versions were investigated during this project. What is more, the
Cure53, Berlin · 04/27/16 1/8
Dr.-Ing. Mario Heiderich, Cure53
Rudolf Reusch Str. 33
D 10367 Berlin
cure53.de · mario@cure53.de
project benefit from ongoing communications between the Cure53 testers and the
MetaMask team, with a development-centered dedicated Slack channel being joined by
relevant parties. Though this was envisioned to help clarify any arising questions, the
tests actually went very smoothly and no further discussions were actually necessary.
The discoveries made by this test regarding the MetaMask product were quite scarce
and attest to the overall good security found on the items in scope. Among the
aforementioned six results, four issues constituted security vulnerabilities, while the
remaining two were deemed to be general weaknesses. What is crucial to underscore is
that neither “Critical” nor even “High” level of severity could be attributed to any of the
risks carried by the discoveries.
In the following sections, the report will provide a case-by-case discussion of findings,
alongside mitigation advice and fix recommendations. The closing section will offer a
brief conclusion and delivers a summary assessment of MetaMask from the security
perspective.
Scope
• MetaMask Browser Extension
◦ https://github.com/MetaMask/metamask-extension
• MetaMask in Chrome Web Store
◦ https://chrome.google.com/webstore/detail/metamask/nkbihfbeogaeaoehlefnkodbefg
pgknn
• MetaMask via Service Worker
◦ https://github.com/MetaMask/metamask-extension/tree/master/mascara
Cure53, Berlin · 04/27/16 2/8
Dr.-Ing. Mario Heiderich, Cure53
Rudolf Reusch Str. 33
D 10367 Berlin
cure53.de · mario@cure53.de
Identified Vulnerabilities
The following sections list both vulnerabilities and implementation issues spotted during
the testing period. Note that findings are listed in a chronological order rather than by
their degree of severity and impact. The aforementioned severity rank is simply given in
brackets following the title heading for each vulnerability. Each vulnerability is
additionally given a unique identifier (e.g. MM-01-001) for the purpose of facilitating any
future follow-up correspondence.
MM-01-002 Extension: Phishing Detector can be bypassed (Medium)
It was found that the Phishing Detector, which works with a set of blacklisted domains,
can be bypassed. Normally, if a blacklisted domain is accessed by the user, the
MetaMask detector will try to redirect the user to the warning page. The logic is
implemented inside the content script of the browser extension and can be found on the
following line.
Affected Line:
https://github.com/MetaMask/metamask-
extension/blob/0e6bc6647ee5c0554a4e149514c87ca4d8585d2c/app/scripts/contentscri
pt.js#L97-L100
Redirect Code:
function redirectToPhishingWarning() {
console.log('MetaMask - redirecting to phishing warning');
window.location.href = 'https://metamask.io/phishing.html';
}
However, a malicious page can negate the redirect effect by aborting the page load with
window.stop. This behavior is shown below.
PoC:
<script>
var i =50;
var si=setInterval(function(){
if(--i){
window.stop();
}else{
clearInterval(si);
document.write("<h1>This is black-listed page</h1>");
}
},10);
</script>
Cure53, Berlin · 04/27/16 3/8
Dr.-Ing. Mario Heiderich, Cure53
Rudolf Reusch Str. 33
D 10367 Berlin
cure53.de · mario@cure53.de
It is recommended to use the WebRequest API1 to block the access to a blacklisted
domain before users can visit it. This mechanism should be more robust rather than
being prone to interruptions from the website’s DOM.
MM-01-003 Extension: Unsafe Background Script Communications (Info)
The communication model implemented by the extension at present transfers any data
sent by a web page to the background script via the content script. It was discovered
that the content script does not enforce any checks with respect to the validity of the sent
JSON structure. The following example of a JSON structure demonstrates that not only
any value can be specified for known keys, but additional keys are also permitted.
The data sent via postMessage from a website is supplied next.
data = {"target":"contentscript","data":{"name":"provider","data":
{"jsonrpc":"1337.0","method":"cure53_test","whatever": "test","params":
[{"from":"123","test":"1"}],"cure53":"key"},"key":"key"}}
window.postMessage(data,"*");
Data received by the background script:
PortDuplexStream - saw message {"name":"provider","data":
{"jsonrpc":"1337.0","method":"cure53_test","whatever":"test","params":
[{"from":"123","test":"1"}],"cure53":"key"},"key":"key"}
Although this behavior did not introduce any security vulnerabilities, implementing a
validation scheme in the content script should be taken into consideration. A revised
approach would ensure that a hypothetical vulnerability in the background script cannot
be reached by a malicious web page.
MM-01-005 Web: Missing Clickjacking protection on MetaMascara (Info)
It was found that MetaMascara, which is a ServiceWorker-based variation of the
MetaMask extension, is framable. This allows an attacker to embed the site using an
Iframe and overlay something on top of it.. As a result, users may be tricked into clicking
on something other than what they actually intended to click on. The resulting attack
strategy is known as Clickjacking2. In the context of the tested product, however,
performing a critical action would require multiple clicks and data input, which largely
mitigates this issue.
PoC:
<iframe style="opacity:0.2" src="//localhost:9001"></iframe>
1 https://developer.chrome.com/extensions/webRequest
2 https://en.wikipedia.org/wiki/Clickjacking
Cure53, Berlin · 04/27/16 4/8
Dr.-Ing. Mario Heiderich, Cure53
Rudolf Reusch Str. 33
D 10367 Berlin
cure53.de · mario@cure53.de
Fig.: MetaMascara being framed with low opacity
To observe the logic behind this issue, simply use the above code and save it as a
HTML file. Consequently, the site will be rendered framed and enables Clickjacking
attacks. Though there is currently no risk associated with this problem, it is nevertheless
recommended to deploy proper Clickjacking protections by including the X-Frame-
Opt