| Titel | extension.vn 2FA Authenticator Chrome extension 1.0.0.2 Information Disclosure |
|---|
| Beschreibung | ## Summary
2FA Authenticator Chrome extension version x.x.x.x exposes extension storage through `chrome.runtime.onMessageExternal` without restricting which external extensions are allowed to send messages.
The background service worker registers an external message listener and routes external messages into the same handler used for internal extension messages. The handler accepts a `get_data_storage` request and returns stored data without validating the sender extension ID against an allowlist.
The extension stores TOTP entries under the `list_secret_key_2fa` storage key. These entries include account metadata and the TOTP secret key. A malicious co-installed Chrome extension can send a `get_data_storage` message to the affected extension ID and read the stored TOTP secrets. With those secrets, an attacker can independently generate valid TOTP codes for the victim's accounts.
The vendor confirmed that the reported issue was valid. The vendor stated that it removed `chrome.runtime.onMessageExternal`, added sender validation for internal messages, and was preparing an updated release after final checks. Vendor confirmation is available privately on request.
## Impact
Successful exploitation allows a malicious co-installed browser extension to read the victim's stored TOTP secrets from 2FA Authenticator.
The practical impact is severe because TOTP secrets are long-lived shared secrets. Once extracted, an attacker can generate valid one-time passwords independently, even if the victim later closes the browser or stops using the malicious extension. If the attacker also obtains the corresponding account passwords through another channel, the stolen TOTP secrets can defeat the second factor for affected accounts.
The vulnerable message handler also exposes a storage write path through `set_data_storage`, which may allow an external extension to modify extension storage if reachable in the same way. The primary confirmed impact in this report is unauthorized disclosure of TOTP secrets.
## Technical Details
The background service worker registers a listener for external extension messages:
```javascript
chrome.runtime.onMessageExternal.addListener((req, sender, sendResponse) => a(req, sender, sendResponse));
```
The same handler function is also used for internal extension messages:
```javascript
chrome.runtime.onMessage.addListener((req, sender, sendResponse) => a(req, sender, sendResponse));
```
The shared handler accepts storage operations:
```javascript
case "get_data_storage":
return n(req, sendResponse), true;
case "set_data_storage":
return s(req, sendResponse), true;
```
No sender validation was found before the external message path reaches the storage operation handler. In particular, the handler does not restrict `sender.id` to a trusted allowlist before returning storage data.
The TOTP secret list is stored under `list_secret_key_2fa`. Entries include the issuer, website, account, and TOTP secret key:
```javascript
list = list.concat([{
issuer,
website: window.location.origin,
account,
secretKey
}]);
await storage.setItem("list_secret_key_2fa", JSON.stringify(list));
```
The resulting data flow is:
```text
malicious co-installed extension
-> chrome.runtime.sendMessage("lihconfopkpbjpkbbcpofjofmpaopgol", { type: "get_data_storage", key: "list_secret_key_2fa" })
-> 2FA Authenticator onMessageExternal handler
-> shared storage handler without sender allowlist
-> stored TOTP secrets returned to the malicious extension
```
The following controls were missing in the affected version:
- Validation of `sender.id` against a trusted allowlist for external messages
- Removal or restriction of `chrome.runtime.onMessageExternal`
- Separation of internal and external message handlers
- Encryption or other strong protection for stored TOTP secrets at rest
## Proof of Concept
The following proof of concept should be performed only in a controlled browser profile with test TOTP entries.
Prerequisites:
1. 2FA Authenticator version x.x.x.x is installed.
2. At least one test TOTP secret is stored in the extension.
3. A separate test extension is installed in the same browser profile.
From the separate test extension, send an external message to the affected extension ID:
```javascript
chrome.runtime.sendMessage(
"lihconfopkpbjpkbbcpofjofmpaopgol",
{
type: "get_data_storage",
key: "list_secret_key_2fa"
},
response => {
console.log(response);
}
);
```
Expected safe behavior:
The target extension should reject the request because the sender extension is not trusted.
Observed vulnerable behavior:
The target extension returns the requested storage data to the external sender. If the key is `list_secret_key_2fa`, the returned data contains stored TOTP entries and their secret keys.
## Suggested CVSS
Suggested CVSS v3.1 vector:
`CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N`
Suggested severity: Critical
Rationale: exploitation requires a malicious extension to be installed in the victim's browser, which is represented as local attack vector with low privileges and user interaction. The attack crosses the malicious-extension to victim-extension trust boundary. Confidentiality impact is high because all stored TOTP secrets can be exposed. Integrity impact is high because possession of TOTP secrets can allow generation of valid second-factor codes for protected accounts when combined with account passwords. No direct availability impact is claimed.
If VulDB scores only the direct impact to the extension storage itself and not downstream account compromise, a more conservative vector may be:
`CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N`
## Suggested CVE Description
extension.vn 2FA Authenticator Chrome extension x.x.x.x exposes stored TOTP secrets through an unrestricted external message handler. The background service worker registers `chrome.runtime.onMessageExternal` and routes external messages to a shared storage handler without validating the sender extension ID. A malicious co-installed extension can send a `get_data_storage` request for `list_secret_key_2fa` and retrieve stored issuer, account, and TOTP secret key data.
## Remediation Suggestions
- Remove `chrome.runtime.onMessageExternal` unless external extension messaging is strictly required.
- If external messaging is required, validate `sender.id` against a strict allowlist before processing any request.
- Do not route external messages into the same handler used for internal privileged extension messages.
- Reject all external storage read/write operations by default.
- Encrypt or otherwise strongly protect stored TOTP secrets at rest.
- Consider requiring explicit user confirmation before exporting or exposing stored TOTP secrets.
- Add regression tests that verify untrusted external extensions cannot read or write extension storage.
## References
- Chrome Web Store listing: `https://chromewebstore.google.com/detail/2fa-authenticator/lihconfopkpbjpkbbcpofjofmpaopgol`
- Source repository: `https://github.com/buigiathanh/2FA-Authenticator`
- Vendor confirmation: available privately on request
|
|---|
| Quelle | ⚠️ https://github.com/xryj920/chrome_extensions/blob/main/extension.vn%202FA%20Authenticator%x.x.x.x%20exposes%20stored%20TOTP%20secrets%20through%20an%20unrestricted%20external%20message%20handler |
|---|
| Benutzer | DRXYJ (UID 46872) |
|---|
| Einreichung | 01.07.2026 03:49 (vor 2 Monaten) |
|---|
| Moderieren | 31.08.2026 07:03 (2 months later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 397229 [extension.vn 2FA Authenticator Extension 1.0.0.2 auf Chrome Background Service Worker chrome.runtime.onMessageExternal.addListener sender.id Information Disclosure] |
|---|
| Punkte | 20 |
|---|