Mayakshi
Learning Centre for Cyber Security & Privacy Professionals
Bill Toulas
2 Sept 2023
A team of researchers from the University of Wisconsin-Madison has uploaded to the Chrome Web Store a proof-of-concept extension that can steal plaintext passwords from a website's source code.
An examination of the text input fields in web browsers revealed that the coarse-grained permission model underpinning Chrome extensions violates the principles of least privilege and complete mediation.
Additionally, the researchers found that numerous websites with millions of visitors, including some Google and Cloudflare portals, store passwords in plaintext within the HTML source code of their web pages, allowing extensions to retrieve them.
Source of the problem
The researchers explain that the problem concerns the systemic practice of giving browser extensions unrestricted access to the DOM tree of sites they load on, which allows accessing potentially sensitive elements such as user input fields.
Given the lack of any security boundary between the extension and a site's elements, the former has unrestricted access to data visible in the source code and may extract any of its contents.
Additionally, the extension may abuse the DOM API to directly extract the value of inputs as the user enters them, bypassing any obfuscation applied by the site to protect sensitive inputs, and stealing the value programmatically.
Potential for exploitation
Notable website examples of lack of protections highlighted in the report include:
gmail.com – plaintext passwords on HTML source code
cloudflare.com – plaintext passwords on HTML source code
facebook.com – user inputs can be extracted via the DOM API
citibank.com – user inputs can be extracted via the DOM API
irs.gov – SSNs are visible in plaintext form on the web page source code
capitalone.com – SSNs are visible in plaintext form on the web page source code
usenix.org – SSNs are visible in plaintext form on the web page source code
amazon.com – credit card details (including security code) and ZIP code are visible in plaintext form on the page's source code
