| タイトル | ByteDance Coze Scraper Chrome extension 2.0.2 Information Disclosure |
|---|
| 説明 | Coze Scraper Chrome extension 2.0.2 exposes scraping functionality to any HTTP or HTTPS website through an unrestricted externally_connectable configuration and an external message handler that does not validate the sender origin.
The extension manifest declares externally_connectable.matches as ["http://*/*", "https://*/*"]. The background service worker in static/background/index.js registers chrome.runtime.onMessageExternal.addListener and dispatches externally supplied commands including record, paginationCollect, and subPageCollect without enforcing a sender.url or sender origin allowlist.
The record command accepts body.url from the external message, opens that URL in a popup window, injects the extension's scraping content script, waits for the recordCompleted workflow, and returns the result through the external message response. The paginationCollect and subPageCollect handlers use the same trust pattern with body.url/body.urls and execute scraping logic in pages selected by the external caller.
An attacker-controlled webpage can therefore cause the victim's installed Coze Scraper extension to open and scrape arbitrary URLs selected by the attacker. The opened pages run in the victim browser and may be accessible because of the victim's authenticated session or network position. The scraped result is returned to the external sender. This is a browser-side confused deputy issue and can result in disclosure of authenticated web content or internal/intranet pages reachable from the victim browser.
Affected file and parameters:
manifest.json: externally_connectable.matches
static/background/index.js: chrome.runtime.onMessageExternal.addListener
record command: body.url
paginationCollect command: body.url, paginationConfig, xPathConfig
subPageCollect command: body.urls, xPaths
Suggested CWE:
CWE-862 Missing Authorization
CWE-863 Incorrect Authorization
CWE-441 Unintended Proxy or Intermediary
Suggested CVSS v3.1:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Suggested severity:
High
Remediation:
Restrict externally_connectable.matches to trusted Coze-controlled origins only. Validate sender.url or sender origin against a strict allowlist before handling external messages. Reject record, paginationCollect, and subPageCollect from untrusted external senders. Do not allow arbitrary target URLs from untrusted external messages. Add regression tests confirming that arbitrary HTTP and HTTPS origins cannot trigger scraping commands. |
|---|
| ソース | ⚠️ https://github.com/xryj920/chrome_extensions/blob/main/Coze%20Scraper%202.0.2%20Unrestricted%20External%20Message%20Handler%20Allows%20Website-Triggered%20Arbitrary%20URL%20Scraping |
|---|
| ユーザー | DRXYJ-01 (UID 100089) |
|---|
| 送信 | 2026年07月24日 11:01 (2 月 ago) |
|---|
| モデレーション | 2026年09月23日 17:38 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 409003 [ByteDance Coze Scraper Extension 迄 2.0.2 External Message index.js chrome.runtime.onMessageExternal.addListener 特権昇格] |
|---|
| ポイント | 20 |
|---|