You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Enclica Messenger Desktop Application does not correctly limit in-app navigation.
Platform(s) Affected:
MacOS, Linux, Windows
Steps To Reproduce:
Open the Enclica Messenger Desktop Application from the command-line. Add a command-line switch --remote-debugging-port=8315 while running the application.
Open a web browser on the same device and visit localhost:8315. The application can be interacted with via the DevTools protocol.
[Access Sensitive File] Within the console, update the location, say, window.location = “https://malicious.com”. The application window is navigated to a third-party domain.
Additionally, the app accesses tokens from local storage. It can instead benefit from storing tokens as cookies and encrypting them using @electron/fuses. [Link]
–
Mir Masood Ali, PhD student, University of Illinois at Chicago
Mohammad Ghasemisharif, PhD Candidate, University of Illinois at Chicago
Chris Kanich, Associate Professor, University of Illinois at Chicago
Jason Polakis, Associate Professor, University of Illinois at Chicago
The text was updated successfully, but these errors were encountered:
Summary:
The Enclica Messenger Desktop Application does not correctly limit in-app navigation.
Platform(s) Affected:
MacOS, Linux, Windows
Steps To Reproduce:
--remote-debugging-port=8315
while running the application.localhost:8315
. The application can be interacted with via the DevTools protocol.window.location = “https://malicious.com”
. The application window is navigated to a third-party domain.Additionally, the app accesses tokens from local storage. It can instead benefit from storing tokens as cookies and encrypting them using
@electron/fuses
. [Link]–
Mir Masood Ali, PhD student, University of Illinois at Chicago
Mohammad Ghasemisharif, PhD Candidate, University of Illinois at Chicago
Chris Kanich, Associate Professor, University of Illinois at Chicago
Jason Polakis, Associate Professor, University of Illinois at Chicago
The text was updated successfully, but these errors were encountered: