It’s unclear whether or not all the countless individuals who have the Adobe Acrobat browser extension put in actually use it. The extension being installed routinely together with the Adobe Acrobat utility, chances are that they don’t even learn about it. But safety-clever it doesn’t matter, an extension that’s put in and unused may nonetheless be exploited by malicious actors. So just a few months in the past I determined to have a look. To my shock, the extension itself did almost nothing despite having a fairly appreciable code dimension. It’s the truth is little more than a technique to current Adobe Document Cloud by way of an extension, the entire consumer interface being hosted on Adobe’s servers. And that’s the place bother starts, it’s arduous to maintain these privileges restricted to Adobe properties. Companies don’t normally like safety studies stating that one thing unhealthy may occur. While I ultimately succeeded, this investigation yielded a bunch of useless ends which are interesting on their very own. These have been reported to Adobe, and I’ll define them in this text as well.
TL;DR: Out of six issues reported, only one is resolved. The main problem received a partial repair, two more got fixes that didn’t fairly handle the issue. Two (admittedly minor) points haven’t been addressed at all inside ninety days from what I can tell. Why does identical-origin coverage matter? Why does same-origin coverage matter? The identical-origin coverage is essentially the most basic security concept of the online. So even for those who go to a malicious web site, that webpage is restricted to doing mischief within its own bounds – or exploiting web sites with safety vulnerabilities. What occurs if that safety boundary breaks down? Suddenly a malicious webpage can impersonate you in direction of different websites, even when these don’t have any identified vulnerabilities. Are you logged into Gmail for example? A malicious webpage can request your knowledge from Gmail, downloading all your email conversations. After which it can ask Gmail to send out emails in your title.
Similarly in case you are logged into Twitter or Facebook, your personal messages are now not personal. And your lively on-line banking session will allow that malicious webpage to examine your transaction historical past (fortunately not making any transfers, that usually requires authorization through a second issue). Now you hopefully get an thought why a gap in the same-origin policy is a important vulnerability and must be prevented at any value. Next: Adobe Acrobat extension. As I mentioned before, the Adobe Acrobat extension doesn’t really do something by itself. So once you edit a PDF file for example, you aren’t really in the extension – you’re in Adobe’s Document Cloud. You are utilizing an internet application. Now that web software has an issue: with the intention to do something with a PDF file, it needs to access its information. And with it hosted anyplace on the internet, identical-origin coverage gets in the way. The standard solution would be utilizing a proxy: let some Adobe server download the PDF file and provide the info to the net application.
Downside right here: proxy server can not entry PDF files hosted agreement on fisheries subsidies some firm intranet, and neither PDF files that require the person to be logged in. These can solely be accessed via user’s browser. So Adobe went with another answer: let the extension “help” the net software by downloading the PDF knowledge for it. The extension page will try and download knowledge from the address it received via pdfurl parameter and ship it to the body via window.postMessage(). This would be mostly positive should you navigating to some PDF file were a obligatory step of the method. ’s manifest. This means that any web site is allowed to load chrome-extension://efaidnbmnnnibpcajpcglclefindmkaj/viewer.html and give it whatever value for pdfurl. Google homepage and intercepting the ensuing knowledge would give attackers entry to your Google user identify for instance. Even where CSP is used, its protection is weakened considerably by allowing scripts from a large number of different companies and by using key phrases like ‘unsafe-eval’.
Should display the problem nicely, what might possibly go wrong? Well, for once Adobe may repair the XSS vulnerability earlier than even taking a look at my proof of idea for this concern. And that’s precisely what they did of course. More than a month after the report they requested me why they couldn’t reproduce the difficulty. To their protection, they didn’t hand over on this situation although I couldn’t deliver a new proof of idea. As of Adobe Acrobat 15.1.3.10, it is partially resolved. I might verify that exploiting it to download regular pages not works. The part waiting for readyReceived and seenPdf variables to be set is new. This might be meant to handle my proof of concept the place the message supply occurred to be an external web page. It doesn’t present any worth past what isValidOrigin() already does however. This access can be utilized to run code in the body and thus send messages with the body being the message supply.
