T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/cdp-proxy.mjs:255- Finding
Unauthenticated API Exposes Privileged Control of the User's Authenticated Browser
- Content
View full analysis
{ const parsed = new URL(req.url, `http://localhost:${PORT}`); const pathname = parsed.pathname; const q = Object.fromEntries(parsed.searchParams); res.setHeader('Content-Type', 'application/json; charset=utf-8'); try { if (pathname === '/health') { const connected = ws && (ws.readyState === WS.OPEN || ws.readyState === 1); res.end(JSON.stringify({ status: 'ok', connected, sessions: sessions.size, chromePort })); return; } await connect(); if (pathname === '/targets') { const resp = await sendCDP('Target.getTargets'); const pages = resp.result.targetInfos.filter(t => t.type === 'page'); res.end(JSON.stringify(pages, null, 2)); } // ... else if (pathname === '/eval') { const sid = await ensureSession(q.target); const body = await readBody(req); const expr = body || q.expr || 'document.title'; const resp = await sendCDP('Runtime.evaluate', { expression: expr, returnByValue: true, awaitPromise: true, }, sid); if (resp.result?.result?.value !== undefined) { res.end(JSON.stringify({ value: resp.result.result.value })); } else if (resp.result?.exceptionDetails) { res.statusCode = 400; res.end(JSON.stringify({ error: resp.result.exceptionDetails.text })); } else { res.end(JSON.stringify(resp.result)); } } ``` ```js server.listen(PORT, '127.0.0.1', () => { console.log(`[CDP Proxy] Running at http://localhost:${PORT}`); connect().catch(e => console.error('[CDP Proxy] Initial connection failed:', e.message)); }); ``` ### Technical Analysis The HTTP API controls Chrome DevTools Protoc ...[truncated 2224 chars]- Remediation
View remediation