T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/open-chrome-debug.sh:14- Finding
Legacy browser-profile synchronization duplicates credentials unrelated to WeRead
- Content
View full analysis
&2 mkdir -p "$PROFILE_DIR" # 仅复制保留登录态所需的文件 local item src dest for item in "${SYNC_ITEMS[@]}"; do src="$CHROME_DEFAULT/$item" dest="$PROFILE_DIR/$item" if [ -e "$src" ]; then mkdir -p "$(dirname "$dest")" cp -f "$src" "$dest" fi done echo "同步完成。" >&2 } ``` ### Technical Analysis When `WEREAD_PROFILE_SYNC_MODE=legacy` is enabled, the script copies Chrome's complete cookie databases, saved-login databases, account-login data, encryption state, and security preferences from the user's default profile into a separate profile. These files are not scoped to `weread.qq.com`. They may contain authentication material and metadata for every website used through the source Chrome profile. Copying the raw databases therefore exceeds the minimum privileges required to export WeRead notes. The default `isolated` mode is safer, and the JavaScript cookie extraction logic subsequently filters cookies by the WeRead host. However, host filtering after profile duplication does not protect unrelated credentials already copied into the remote-debugging profile. The copied profile is then launched with a Chrome DevTools Protocol endpoint: ```bash exec "$CHROME_BIN" \ --remote-debugging-port="$PORT" \ --user-data-dir="$PROFILE_DIR" \ "$START_URL" ``` This increases the exposure of the duplicated browser state to processes that can access the profile directory or its debugging endpoint. # ...[truncated 1415 chars]- Remediation
View remediation