T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/capture-cdp.js:193- Finding
Arbitrary URL Navigation Through an Authenticated Chrome CDP Session
- Content
View full analysis
[OUTPUT_DIR]'); console.error('或设置环境变量: TARGET_URL OUTPUT_DIR CHROME_DEBUG_PORT'); process.exit(1); } console.log(`🔍 连接 Chrome 端口 ${DEBUG_PORT}...`); console.log(`🎯 目标: ${TARGET_URL}`); // 获取已打开的页面 let targets; try { targets = await getChromeTargets(); } catch (err) { console.error('❌ 无法连接 Chrome 调试端口:', err.message); console.log('请确保 Chrome 已启动并带有 --remote-debugging-port 参数'); process.exit(1); } // 查找目标页面（精确匹配 URL） let pageTarget = targets.find(t => t.url === TARGET_URL); let isNewTab = false; if (pageTarget) { console.log(`✅ 找到已打开的页面：${pageTarget.title || '(无标题)'}`); } else { // 没有精确匹配，创建新标签页 console.log('📑 创建新标签页...'); pageTarget = await createNewPage(TARGET_URL); isNewTab = true; console.log(`⏳ 等待页面加载...`); await new Promise(r => setTimeout(r, 10000)); const newTargets = await getChromeTargets(); const updatedTarget = newTargets.find(t => t.url === TARGET_URL); if (updatedTarget && updatedTarget.title) { pageTarget = updatedTarget; } } ``` The shell wrapper also forwards the URL without validation: ```bash TARGET_URL="${1:-${TARGET_URL}}" IS_CLAUDE=false if [[ "$TARGET_URL" == *"claude.ai"* ]]; then IS_CLAUDE=true fi CHROME_DEBUG_PORT=$CHROME_DEBUG_PORT TARGET_URL="$TARGET_URL" OUTPUT_DIR="$OUTPUT_DIR" node capture-cdp.js ``` ### Technical Analysis The Skill advertises support for ChatGPT and Claude share URLs, but the implementation does not parse or validate the URL ...[truncated 2157 chars]- Remediation
View remediation