A Weakness In Chrome & A New Hacking Technique
summary
Finds a real Chrome bug that lets CRLF injection in HTTP/2 turn common 301/302 responses into exploitable redirects, builds end-to-end proof of concept and mass-scans with Nuclei and browser automation with Playwright, discovers reversed header ordering in some Nginx and Cloudflare setups, and invents a new technique called frontjacking that hijacks shared-hosting fronts (S3/GCS/GitHub Pages) to serve attacker content. Tests hit ~12.5k domains, Chromium gets patched, responsible disclosure to some vendors yields mixed responses.
AI-written summary · about
chapters (23)
- 0:00Research journey intro
- 1:28CRLF injection basics
- 3:15CRLF injection to XSS
- 5:22CRLF redirection limits
- 6:47Research edge cases
- 9:55Scanning for CRLF flaws
- 11:59HTTP/2 vulnerability role
- 14:08Testing Chromium browsers
- 16:13Nginx header swapping
- 17:38Cloudflare Railgun behavior
- 21:11URI and documentURI injection
- 22:56Host header shared hosting risks
- 26:27Front-end hijacking PoC
- 28:07Frontjacking demo
- 30:26Introducing Frontjacking
- 33:16Automated front-end scanning
- 35:23Vulnerable shared hosting
- 37:52Disclosure and vendor responses
- 39:15Research findings recap
- 41:21Hyver risk quantification
- 42:10Q&A session part one
- 45:04Q&A session part two
- 46:47Q&A session part three
related talks
43mThe Most Secure Browser? Pwning Chrome from 2016 to 2019
35mServer-Side Browsers: Exploring the Web’s Hidden Attack Surface
55mCall To Arms: A Tale of the Weaknesses of Current Client-Side XSS Filtering
42mModern web application bugs
19mWeb Platform Security
33mHacking The Front-End
56mModern Web Vulnerabilities 2020
43mAttacking Modern Web Technologies