Loading HuntDB...

Missing Line Terminator on allowedOrigins enables origin spoofing

High
M
MetaMask
Submitted None

Team Summary

Official summary from MetaMask

@pkkr identified a vulnerability in our Snaps `allowedOrigins` functionality, a functionality which allows a Snap developers to control which origins could interact with certain Snaps APIs. Due to a missing regex terminator, this origin control could be bypassed, allowing a malicious domain to access restricted parts of the Snaps API. At its worst, this would enable malicious dApps to call the Keyring API’s `exportAccount` method, potentially accessing sensitive account information from Snaps who choose to implement it. Not only did @pkkr identify this impactful vulnerability, but did so with incredible timing. His prompt report allowed us to address the issue before it reached production. We would like to thank @pkkr for his continued efforts to demonstrate the impact of this vulnerability and for consistently helping to make MetaMask more secure.

Reported by pkkr

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Improper Access Control - Generic