T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/beatport-cdp.js:166- Finding
Browser-Wide Cookie Disclosure Through CDP
- Content
View full analysis
{ const id = Date.now(); const handler = (m) => { const d = JSON.parse(m.toString()); if (d.id === id) { ws.removeListener("message", handler); resolve(d.result.cookies); } }; ws.on("message", handler); ws.send(JSON.stringify({ id, method: "Network.getAllCookies", params: urls ? { urls } : {} })); }); } ``` ### Technical Analysis The exported helper invokes `Network.getAllCookies`, which retrieves cookies available to the attached browser profile rather than limiting retrieval to the Beatport authentication cookies required by the Skill. The function can also be called without a URL argument. Passing `urls` in the request does not provide a reliable security boundary for `Network.getAllCookies`. Consequently, if the CDP instance uses a shared browser profile, the result may include authentication cookies for unrelated websites open in that profile. This exceeds minimum privilege because the declared functionality only requires Beatport cookies or operation within an already authenticated Beatport page. ### Attack Path 1. A caller loads `scripts/beatport-cdp.js`. 2. The caller discovers or selects a page attached to the local CDP endpoint. 3. The caller establishes a WebSocket connection using `connectPage`. 4. The caller invokes `getCookies(ws)` without a restrictive argument. 5. Chrome returns cookies from the attached browser profile. 6. The caller extracts unrelated session tokens and attempts to replay them against their corresponding services. ### Impact Assessment A malicious or compromised workflow could disclose session cookies belonging to unrelated w ...[truncated 345 chars]- Remediation
View remediation