| 제목 | Orange View Limited DualSafe Password Manager & Digital Vault 1.4.35 Information Disclosure |
|---|
| 설명 | ## Summary
DualSafe Password Manager & Digital Vault Chrome extension version 1.4.35 implements a `postMessage`-based bridge in its content scripts that can respond to credential and TOTP requests from page-level scripts without validating `event.origin`.
The bridge allows a page-side script to register a message source and then request vault data through message types such as `GETLIST` and `GETTOTP`. The extension then sends sensitive responses back with `postMessage(..., "*")`. Because the target origin is unrestricted and the request origin is not validated, any script running in the same page context can receive sensitive data intended to be protected by the password manager.
In a realistic scenario, a malicious webpage, injected script, compromised advertisement, or XSS payload running in a page can interact with the bridge while the extension is installed and the vault is unlocked. The exposed data can include stored username/password entries and live TOTP codes.
The vendor has confirmed that its R&D team reviewed the code and located the potential vulnerability. The vendor stated that a fix will be applied, tested, and deployed in an upcoming update. Vendor confirmation is available privately on request.
## Impact
Successful exploitation can expose saved credentials and live TOTP codes from the password manager to an unauthorized page script. This can allow compromise of accounts for which the password manager stores both the password and TOTP secret.
The confirmed impact is sensitive information disclosure from the extension's vault access path. Where the exposed credentials and TOTP codes are valid for third-party services, the practical result may include account takeover of those services.
The vulnerability requires the extension to be installed and the vault to be in a state where the content-script bridge can retrieve entries. Exploitation also requires user interaction in the form of visiting or interacting with a page where an attacker-controlled script runs.
## Technical Details
The extension uses content scripts to communicate with page-level scripts through `window.postMessage`. The vulnerable bridge registers page-side message sources without validating the message origin.
In `events.js`, any source that sends a `REG_SRC` message is added to `primitiveIframesSet`:
```javascript
if ("REG_SRC" === r.data.type) {
primitiveIframesSet.set(r.source, { __primitiveIframesSetCnt: 1 });
r.source.postMessage({ type: "replyREG_SRC", data: { topUrl: window.location.href } }, "*");
}
```
No validation of `r.origin` is performed before registration. The response is also sent with target origin `"*"`.
The credential list retrieval path sends a request to the extension background and then posts the resulting credential list back to the page context:
```javascript
async fgetlist(_data) {
chrome.runtime.sendMessage({ TYPE: "GETLIST", data: { domain: _data.domain } }, response => {
this.certifications = response.lst;
top.postMessage({ type: "replyGETLIST", data: { certifications: show } }, "*");
});
}
```
The TOTP retrieval path obtains a TOTP value from a stored secret and posts it back to the page context:
```javascript
async fgettotp(_data) {
let secret = this.certifications[index].login.totp;
let totp = await sendMsg({ TYPE: "GET_TOTP", secret });
top.postMessage({ type: "relpyGETTOTP", data: totp }, "*");
}
```
The following controls were not found in the affected bridge:
- Validation of `event.origin` against a strict allowlist
- Restriction of `postMessage` target origin for sensitive responses
- One-time token or nonce to bind requests to trusted extension-controlled contexts
- User confirmation before exposing sensitive credential or TOTP data
This creates a data flow from an unauthenticated page-controlled message to extension background credential retrieval and then back to a page-observable `postMessage` response:
```text
page-controlled script
-> postMessage REG_SRC / GETLIST / GETTOTP
-> content-script bridge accepts the source without origin validation
-> extension background retrieves vault data or TOTP code
-> content script sends sensitive response with target origin "*"
-> page-controlled script can read credentials or TOTP data
```
## Proof of Concept
The following reproduction should be performed only with a local test page and test vault entries, not with real accounts or real credentials.
Prerequisites:
1. DualSafe Password Manager & Digital Vault version 1.4.35 is installed.
2. The vault is unlocked.
3. A test credential and optional test TOTP entry exist in the vault.
4. A local test page is opened in the browser.
High-level reproduction:
1. From the test page, send a `postMessage` with type `REG_SRC`.
2. Observe that the content-script bridge registers the page source and responds with `replyREG_SRC`.
3. From the same page context, send a message requesting a credential list for a chosen domain through the bridge.
4. Observe that the extension returns credential data in a `replyGETLIST` message using target origin `"*"`.
5. If the returned credential entry contains a TOTP secret, send a TOTP request through the same bridge.
6. Observe that the extension returns a live TOTP value in a page-observable `postMessage` response.
Expected safe behavior:
The extension should reject messages from untrusted origins and should not expose credential or TOTP data to page-controlled scripts.
Observed vulnerable behavior:
The extension accepts page-controlled bridge messages without origin validation and returns sensitive data through unrestricted `postMessage` responses.
## Suggested CVSS
Suggested CVSS v3.1 vector:
`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N`
Suggested severity: Critical
Rationale: exploitation can be delivered through a webpage or injected page script and requires user interaction because the user must visit or interact with an attacker-controlled page while the extension is installed and the vault is accessible. The vulnerability crosses the webpage-to-extension trust boundary. The confirmed confidentiality impact is high because stored credentials and TOTP codes can be disclosed. Integrity impact is rated high because exposed credentials and live TOTP codes can enable unauthorized access to third-party accounts.
If VulDB scores only the direct impact to the extension component and does not include downstream account takeover, a more conservative vector may be:
`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N`
## Suggested CVE Description
Orange View Limited DualSafe Password Manager & Digital Vault Chrome extension 1.4.35 exposes stored credentials and TOTP codes through an unauthenticated `postMessage` bridge. The content scripts accept page-level messages such as registration, credential list, and TOTP requests without validating `event.origin`, and return sensitive responses using target origin `"*"`. A malicious webpage or injected page script can retrieve password manager data when the extension is installed and the vault is accessible.
## Remediation Suggestions
- Validate `event.origin` against a strict allowlist before processing any page-to-extension bridge message.
- Do not use `"*"` as the target origin for responses containing sensitive data.
- Use an extension-controlled request channel where possible instead of exposing vault operations to page-level scripts.
- Add a one-time nonce or capability token to bind requests and responses to a trusted extension-controlled context.
- Require explicit user confirmation before exposing credential or TOTP data to any page-associated context.
- Ensure that credential and TOTP retrieval requests are bound to the actual top-level page origin and cannot request arbitrary domains supplied by page-controlled data.
## References
- Chrome Web Store listing: `https://chromewebstore.google.com/detail/dualsafe-password-manager/lgbjhdkjmpgjgcbcdlhkokkckpjmedgc`
- Vendor confirmation: available privately on request
|
|---|
| 원천 | ⚠️ https://github.com/xryj920/chrome_extensions/blob/main/Orange%20View%20Limited%20DualSafe%20Password%20Manager%20%26%20Digital%20Vault%201.4.35%20exposes%20stored%20credentials%20and%20TOTP%20codes%20through%20an%20unauthenticated%20postMessage%20bridge |
|---|
| 사용자 | DRXYJ (UID 46872) |
|---|
| 제출 | 2026. 06. 30. AM 11:41 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 16. PM 07:47 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 391193 [Orange View Limited DualSafe Password Manager & Digital Vault Extension postMessage-based Bridge 정보 공개] |
|---|
| 포인트들 | 20 |
|---|