feat(chrome): add CVE-2016-5217

Author: Metnew

chrome/CVE-2016-5217/README.md

@@ -0,0 +1,37 @@
+# Security: Use of unvalidated URL in PDF viewer
+
+> Reported by [email protected], Oct 9 2016
+
+## VERSION
+
+Stable (53.0.2785.116) and latest (56.0.2886.0)
+
+## Summary
+
+When a PDF is opened in Chrome, the PDFium plugin is used as follows:
+
+(1) <embed> by webpage -> Chrome loads PDF plugin
+  (2) PDF plugin loads <iframe> with PDF helper extension.
+    (3) PDF helper extension loads <embed> with privileged plugin.
+      (4) Privileged plugin trusts any messages from the host.
+
+A limited API is available between (1) and (2); for same-origin PDFs, this includes reading the content of the PDF.
+The plugin at (4) cannot be loaded by a web page (after  bug 520422 ).
+
+Now I found that (3) is web-accessible [1] *and* trusts the query string to contain the real URL (originUrl_). This URL is used for multiple security decisions, including but not limited to:
+- The originUrl_ can be set to a PDF that redirects elsewhere, and because the helper extension thinks that it's dealing with a same-origin PDF, it will happily leak cross-origin data.
+- The API for chrome://print pages is more extensive, it can be used to load any PDF, and be used to open e.g. file:-URLs in a new tab.
+
+### PoC
+
+I have attached a PoC for the above two examples.
+1. Start server.py (this is for the second example).
+2. If using Chrome 53, start with --isolate-extensions to force Site isolation for extensions (this is on a field trial in 53, and enabled by default in Chrome 54). This is needed to allow the chrome:// resources in the helper extension to load (otherwise the frame will run in the unprivileged tab process).
+3. Open http://localhost:8100
+4. Click on the second button, and see the content of a PDF at another origin being printed in the page.
+5. Click on the first button, and see file:///etc/passwd (or C:\ on Windows) being opened in a new tab (this example does not work in Chrome 54+ any more because the helper extension can no longer embed the chrome://print plugin).
+
+
+> TL;DR Use of unvalidated URL, leading to multiple issues including a same origin bypass. Site isolation made the vulnerability exploitable.
+
+Link: https://bugs.chromium.org/p/chromium/issues/detail?id=654280