Security Issue into Wallet lock protection
High
H
Hiro
Submitted None
Actions:
Reported by
bug_vs_me
Vulnerability Details
Technical details and impact analysis
# Description
While testing wallet extension i generally try to test multiple endpoints, so 2 tabs were open of wallet on chrome-extension://ldinpeekobnhjjdofggfgjlcehhmanlj/popup.html
So i tried to lock Wallet extension buti found that i can still use browser in 2nd tab, why i had already locked wallet,
So there is a security issue where wallet is not properly encrypted after user press lock
Wallet should close all open tabs of wallets and encrypt data for all tabs, It's very insecure way of password protection or lock protection
# Steps To reproduce
To understand clearly i had created a POC video
{F2061644}
1. Open two tabs of chrome-extension://ldinpeekobnhjjdofggfgjlcehhmanlj/popup.html
2. lock wallet in any of 1 tab and you can see you can access wallet on other tab and still able to do transaction as shown in POC{F2061648}
# HOW to fix?
Edit code and make sure when user click on lock wallet wallet should encrypt data in all tabs or close rest of the tabs to protect user and make lock protection work more securely
Thank you
## Impact
This is totally fail of lock protection AND attacker can use this vulnerability to craft custom attacks
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Improper Authentication - Generic