CVE-2022-0337-PoC-Google-Chrome-Microsoft-Edge-Opera - 🎩 🤟🏻 [P1-$10,000] Google Chrome, Microsoft Edge an

项目说明

<di="center" >🤝 Show your support - give a ⭐️ if you liked the content | <a target="_blank" href=' on Twitter</a>
| Follow me on
<a target="_blank" href=' src='
<a target="_blank" href=' src='
</div>

---

C System en leak on Google Chrome, Microsoft Edge and Opera

📝 Description

Successful exploitation of this can lead to the leak of user's secrets stored inside a system en . A security bug was found in Chromium 92 and patched in 97 . There are several web browsers based on the chromium engine, for instance, Google Chrome, Microsoft Edge, Opera, and Brave. All of them were , except for Brave. The is in the File system access API, more specifically in window.showSa() method.

---

C: C

Credits: Maciej Pulikowski

Reward: $10,000 from Google VRP

---

Web browser :

|  |  |  |  |  |
| :-------------------------------------------------------------------------------------------: | :-------------------------------------------------------------------------------------: | :----------------------------------------------------------------------------------------: | :----------------------------------------------------------------------------------------------: | :----------------------------------------------------------------------------------------: |
| 92-96 ❗️❗️ <br> 97+ Patched (safe) ✔ | 92-96 ❗️❗️<br>97+ Patched (safe) ✔ | 78-82 ❗️❗️<br>82 Patched (safe) ✔ | Safe ✔ | Safe ✔ |

Check your web-browser :

Google Chrome: chrome:///

Microsoft Edge: edge:///

Opera: opera://update

Operation Systems:

ONLY WINDOWS are . Linux and Mac are safe.

📺 Youtube Proof of Concept

![PoC Video]()

Thanks for the thumbs up and subscriptions 😀👍

👨‍💻 Code Proof of concept

The simplest one

!proof of concept gif

1. Write in your De:

2. Save file
3. Your username should appear

In the example, it is used a %username% en . It returns Windows username logged in. Moreover, there are much more interesting en :

Here are some examples:

AWS_SECRET_ACCESS_KEY

AZURE_CLIENT_SECRET

binance_secret

GITHUB_TOKEN

GOOGLE_API_KEY

and many more...

So the attacker could gain an access to targets AWS services, Github account or Binance token to API (withdraw money) and more...

Check out more secrets in en on my repository:

🦄🔒 Awesome list of secrets in en 🖥️

![🦄🔒 Awesome list of secrets in en 🖥️]()

---

Crafted HTML with impro

The previous example is run in local Google Chrome De.

Ob, the attacker could craft a special HTML file (website) to do successful exploitation of this .

env.html - is an example of crafted special HTML in the repository.

But, do really user is required to download a file?

Yes, however, the attacker can create a website to encourage User to hold ENTER button on keyboard for 2 seconds to run and accept saving file dialog. Because windows dialog by default focus Sa, file will be saved with only blink.

!en on website (1)
_*.gif is from Opera (Chrome and Edge were already fixed)_

In conclusion, user after holding the ENTER button on keyboard for 2 seconds could lead to leak of his system en . This is a significant problem because user could store important secrets in system en ex. Access to his AWS services, Github account or Binance

🧠 Things to remember from the write-up:

En can store secrets ex. tokens, api-key, secrets

if payload "%USERNAME%" or "\$:USERNAME" or "\${USERNAME}" or "$USER" return real username then target is

🔨 Fix in chromium

I ga challange to repair the bug. Here, I would like to underline that I am not a c++ dev 😎.

source:

One of solution was to just replace character % in suggestedName to _ . It should solve the problem.

My solution:

!image

could be insert in:

and the results are:

Before fix:

!image

After my fix:

!image

Indeed it solved the problem, but it wasn't the best place to insert the code 😋 . However, I was very happy to manage to repair it by myself 😎

Final fix can be found here:

🌌 Timeline

[07.09.2021, 10:40 PM GMT+2] Bug reported by Maciej Pulikowski

[07.09.2021, 11:36 PM GMT+2] Bug accepted (Pri:1, Se)

[08.11.2021, 1:30 AM GMT+1] My submit for possible fix in code for chromium source

[10.12.2021, 6:09 PM GMT+1] Fixed

[7.01.2022, 2:09 AM GMT+1] Reward of $10,000

[18.03.2022, 6:30 PM GMT+1] Google remo view restrictions

💻 Useful links

Issue 1247389: Security: Possible to see the user's system en like secrets, tokens or keys

🦄🔒 Awesome list of secrets in en 🖥️

The File System Access API: simplifying access to local files

File System Access - Documentation

File System Access Web API - Chromium Security Model

🤝 Show your support

<div>🤝 Show your support - give a ⭐️ if you liked the content | <a target="_blank" href=' on Twitter</a>
| Follow me on
<a target="_blank" href=' src='
<a target="_blank" href=' src='
</div>
<br>

✔️ Disclaimer

This project can only be used for educational purposes. Using this software against target systems without prior permission is illegal, and any damages from misuse of this software will not be the responsibility of the author.

项目信息

开发语言：HTML

Star 数：341

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕🎩 🤟🏻 [P1-$10,000] Google Chrome, Microsoft Edge and Opera - vulnerability reported by Maciej Pulikowski - System environment variables leak - CVE-2022-0337展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。