Spell-jacking on Google Chrome and Microsoft Edge

Summary

Security researchers from otto-js published a report about a spell-jacking security flaw found on Google Chrome and Microsoft Edge. Depending on the configuration of the browsers, sensitive data could be leaked to third-party services.

• CVE: N/A
• Product affected: API (Pro and CE) and the browser extension
• Version affected: every version under v3.7.3
• Version fixed: v3.7.3
• Affected component: All form inputs.
• Vulnerability Type: spell-jacking
• Severity: N/A

Problem

Google Chrome and Microsoft Edge enhanced spell-checking features send the content of (non-password) form inputs to external third-party services owned by Google and Microsoft. Consequently, these browser features break the end-to-end character of passbolt and leak sensitive users’ data to third party.

Furthermore, if a proxy is enabled at an organisation scale, this proxy will also receive this data.

For Passbolt application it means that the following data could have been leaked:

• Account
  • OTP
  • passphrase
  • private key
  • security token
• Navigation
  • Text in the search bar
• Passwords
  • Passwords metadata
  • Passwords secrets
  • Comments
  • Password generators metadata
  • Share password search text content
• Passwords import/export
  • Keepass file password
• Groups
  • Groups name
  • Add group user search text content
• Folders
  • Folders name
  • Share folder search text content
• Tags
  • Tags name
  • Edit password tags text content
• Administration settings
  • MFA settings except salt and secret keys
  • User directory (LDAP) settings except auth password field
  • Passbolt Pro subscription key
  • Organization account recovery public and private recovery key and relative settings (including passphrase)

Who’s impacted

The users who are using Google Chrome with the advanced spell-checking feature enabled and the users using Microsoft Edge with the MS Editor extension installed.

Fix

The fix consists in adding a spellcheck="false" tag on the body tag of every page served by Passbolt API and the browser extension.

Event Timeline

• 20/09/2022 15:30: Spell-jacking issue is discovered.
• 21/09/2022 09:00: A fix is implemented.
• 26/09/2022: Extension v3.7.3 shipping with the fix is published.
• 27/09/2022: API v3.7.3 shipping with the fix is published.