"1 Day XSLeak and a trailer for ElectronJS bugs"
-Author's writeup for BSides Ahmedabad CTF 2021
On Nov 6th zer0pts hosted a 24h CTF for BSides Ahmedabad Conference, I prepared 3 challenges for the event namely pugpug, bettercatalog, Neutron. I hoped for more players to try my challenges, but because of Google's Hackcelr8 taking place most of the top teams were busy building tooling. So, bettercatalog and Neutron challenges were left unsolved during the event, then I posted the challenges on Twitter for others to try. Gladly, layton got first blood on the next day of the event on bettercatalog challenge and vakzz got first blood after 3 days of the event on Neutron using an unintended dope solution.
TL;DR of the challenges
This is a pretty interesting prototype pollution challenge on the server-side, it is based on a bug found by BlackFan to bypass Object sealing on a bug bounty site. You can find more details of the challenge on huli's blog.
This is a Scroll to Text Fragment XSLeak challenge, based on the bug I found in google chrome which got duped sadly :/.
Neutron is an ElectronJS challenge that has both web and pwn elements, this was based on the real bug which I wasn't able to achieve because of some reason. Basically, the idea is to spoof the origin of the same-site website in a frame to parent's origin to get access to the interesting API on the parent window which is exposed via contextBridge.exposeInMainWorld. As usual, ptr-yudai helped with the pwn part to write a render exploit to spoof the origin of the same-site website using a v8 nday bug by overwriting the security_context_.security_origin_.host_ to the parent's host and document_.url_ to the parent's URL.
I don't want to go into much detail about the solution to this challenge because you can find layton's writeup here. I want to share a funny story about finding this bug.
Details of the challenge
bettercatalog is a copy of the catalog challenge given by bluepichu for PlaidCTF 2020 with an important modification(check the diff in the below image) of removing the uBlock extension in the chromium bot. I highly suggest reading the catalog solution here before reading this.
Basically, scroll to text fragment only works in a top-level browsing context and user-gesture initiated navigations. When a link is clicked in chrome browser with the uBlock extension enabled, it enables user activation to the navigated page. So, bluepichu used this flaw to his challenge to leak the flag via STTF and lazy loading images. In my challenge, I removed the uBlock extension which means that the player either has to find an 0day user activation bypass or use a 1day.
While trying to solve, lbherrera's XSLeak challenge names Messagekeeper in pwn2own CTF. I thought messagekeeper challenge is an XSLeak challenge using STTF, so I spent a lot of time doing various stuff using STTF. At one point, I noticed an interesting behavior of scroll to text fragment taking place in an iframe when navigation is initiated from the same origin site. This is according to this document is a security flaw because for two reasons, first STTF is limited to user-gesture initiated navigations and, second it shouldn't work in an iframe. So, I created a POC and double-checked and it eventually turned out to be a flaw, then I reported which sadly got fixed a week before I submitted it on chrome 92. Check the video POC below, works on chrome 91.
Initially, I thought of writing an application for this challenge, then I remembered the catalog challenge in Plaid CTF with 0 solves. So, I thought why not give the same challenge by removing the uBlock extension and after some hustle, I was able to create POC to leak the flag using my bug. Check the video below
As you may have noticed the title of the blog has "trailer of ElectronJS bugs", which I actually mean because I have a lot of electron desktop application bugs to show 😁.
This challenge is based on a real application where I was able to achieve XSS on an iframe but it doesn't have any interesting electron stuff to show impact, but the parent has some interesting APIs exposed via contextBridge.exposeInMainWorld. Eventually, I failed to pwn the application because the origin which I have XSS on is not same-site, so chrome creates a separate process according to the site-isolation and I know the spoofing doesn't work in this case, so I failed to pwn the application.
I thought why not give a CTF challenge based on this scenario. Then I created a basic electron application where the renderer has a buggy IPC exposed to the main site http://electron.lol:1337 and this site loads a same-site website http://electron.lol:6969 in an iframe which has XSS in it and uses an old version of an electron with Node Integration disabled, Context Isolation enabled and Sandbox enabled. You can find the full source code here.
This is how the application looks
The sanitization of messages takes place via Google Caja which is an ancient sanitiser by google and it is deprecated maybe because of MXSS issues?
Now, the XSS is in electron.lol:6969, it can't access top.safeEval because of same-origin policy. It might seem impossible to achieve RCE because of all these limitations.
Spoofing Origin of same-site page
Because the sites electron.lol:6969 and electron.lol:1337 are same-site, site-isolation won't be applied here. So, chrome uses the same process for both of the pages. Interestingly, with a renderer exploit we can overwrite the origin of our page to different same-site websites and now if we access top.safeEval chrome won't throw SOP error. Here we only need to overwrite the port of the origin.
One main important thing I realized during this whole process is that I have to stop being lazy when it comes to learning v8 exploitation and spend a lot of time learning it😒.