T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/inject_cookies.js:26- Finding
Overbroad Collection and Cross-Domain Injection of Authentication Cookies
- Content
View full analysis
s.trim()).filter(Boolean); for (const pair of pairs) { const eqIdx = pair.indexOf('='); if (eqIdx === -1) continue; const name = pair.substring(0, eqIdx).trim(); const value = pair.substring(eqIdx + 1).trim(); if (!name) continue; // 根据cookie名推断域名 let domain = defaultDomain; if (['ptcz', 'ptui_loginuin', 'RK', 'p_uin', 'p_skey', 'pt4_token'].includes(name)) { domain = '.qq.com'; } else if (['RIO_TOKEN', 'RIO_TOKEN_HTTPS', 'x_host_key_access_https', 'x-client-ssid', 'DiggerTraceId', 'DiggerTraceIdTs'].includes(name)) { domain = '.woa.com'; } const cookie = { name, value, domain, path: '/', }; // 敏感cookie加安全属性 if (['gdt_mlogin', 'gdt_protect', 'tap_free_login_token', 'RIO_TOKEN', 'RIO_TOKEN_HTTPS', 'x_host_key_access_https'].includes(name)) { cookie.secure = true; cookie.httpOnly = true; cookie.sameSite = 'None'; } cookies.push(cookie); } return cookies; } ``` The associated instructions tell the user to run `document.cookie` and send the complete result to the Agent rather than supplying only narrowly scoped credentials. ### Technical Analysis The parser accepts every cookie in the supplied string. It does not enforce an allowlist of cookies required for the declared `ad.qq.com` UX test. It also recognizes selected authentication and internal-ne ...[truncated 2092 chars]- Remediation
View remediation