T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/browser.py:75
- Finding
- Unrestricted Automation of the User's Existing Authenticated Browser Context## Vulnerability Details **File Location**: `scripts/browser.py:75-105` **Vulnerability Type**: Missing browser-session isolation and insufficient authorization boundaries **Risk Level**: High ### Vulnerable Code ```python CDP_ENDPOINT = os.environ.get("BROWSER_CDP_ENDPOINT", "http://localhost:9222") async def get_browser(): """Connect to existing Chrome via CDP. Never launches a new browser.""" p = await async_playwright().start() try: browser = await p.chromium.connect_over_cdp(CDP_ENDPOINT) except Exception as e: print(f"ERROR: Cannot connect to Chrome at {CDP_ENDPOINT}") print(f" {e}") print() print("Make sure Chrome is running with remote debugging:") print(f' chrome.exe --remote-debugging-port=9222') print() print(f"ERROR: 无法连接到 Chrome ({CDP_ENDPOINT})") print("请确保 Chrome 已启用远程调试:") print(f' chrome.exe --remote-debugging-port=9222') sys.exit(1) return p, browser async def get_page(browser): """Get the active page or create one.""" contexts = browser.contexts if not contexts: context = await browser.new_context() else: context = contexts[0] pages = context.pages if not pages: page = await context.new_page() else: page = pages[-1] return page ``` Supporting instructions explicitly tell users that the automation connects to their existing Chrome instance: ```markdown Both connect to your **existing Chrome** via CDP — no new browser instance, no "controlled by automated software" banner. ``` The interaction skill also permits credential entry and immediate form submission: ```markdown ### Login Flow 1. Navigate to login page 2. Find username field → click → type username 3. Find password field → click → type password 4. Click login button 5. Screenshot to verify success ``` # ...[truncated 2644 chars]
- Remediation
- ## Remediation Suggestions 1. Launch automation with a dedicated temporary browser profile rather than attaching to the user's everyday profile. 2. If attachment to an existing browser is necessary, require explicit confirmation before accessing an existing context or tab. 3. Select tabs using an explicit page identifier and expected origin instead of automatically choosing `pages[-1]`. 4. Implement an origin allowlist derived from the user's requested URL and reject navigation or interaction outside that scope. 5. Require confirmation immediately before consequential operations, including login submission, purchases, messages, uploads, account changes, and deletion. 6. Validate the CDP endpoint and default to loopback-only addresses. Require an explicit opt-in and authenticated transport for remote endpoints. 7. Document that CDP grants control with the privileges of all attached authenticated browser sessions. 8. Prefer a separate Chrome invocation using a temporary `--user-data-dir` and remove the profile after the session ends.