Ed · Report #290955
Chrome Extension is vulnerable to the self-DOS issues in case it process the security.txt with a big size
Summary
I found an extension self-DoS issue due to way, how ajax calls process the big files in response. Little correction to the report content, in reproduction steps section, i did a mistake there - there was no Chrome tab crash, but extension crash only.
Thanks to the @edio and @karel_origin for their awesome work!
How it was found
Description
Hello. Before all, thanks for the invite:) Here is keyword: frog
I discovered the self-DOS issue, which affects Chrome extension.
Impact
I marked the impact as low, because it will affect only the browser tab, and will not impact other browser tabs. The issue happens due to processing the large files using AJAX call in the getSecuritytxt function.
Steps to reproduce
- Create security.txt with the size of 1-2 GB on your host.
- Navigate to this site in the Chrome Browser (at this time you may notice traffic and CPU utilization increasing due to pre-flight check of the security.txt)
- Click on the extension. Depending on the Chrome version, amount of RAM and CPU, you can experience one of (or all together):
- Extension hang
- Tab hang
- Tab crash
Suggested fix
Since we are making AJAX calls to the untrusted hosts, end extension is working for the every site we opened in the tab, we should get rid from such kind of issues. I suggest to implement timeout on the AJAX calls using
xhr.timeout = 15000; //some value in milliseconds
xhr.ontimeout = function (e) {
//handling timeout
};
I will link the Github PR in the comment below:)