Executive brief
ARC is a desktop REST client application used by developers to test and debug APIs. When a user clicks on a link in an API response header, the application opens it in a new window with full renderer-process privileges, allowing malicious scripts to access the file system, local data stores (which may contain sensitive credentials), and other ARC-only capabilities. An attacker can exploit this by crafting an HTTP response with a malicious link in the headers.
Technical details
The vulnerability stems from CWE-250 (Execution with Unnecessary Privileges). When clicking a link in a response header, ARC's Electron application opens the target in a new window with the default preload script enabled, granting renderer-process privileges to third-party content. The preload script exposes file system and data store access without additional verification. Attack vector is user interaction (user must click a link in a response header). An attacker can deliver a malicious HTTP response containing a crafted link that, when clicked, executes arbitrary logic with ARC's renderer-process privileges, including accessing the file system and internal data stores. The vulnerability is patched in version 0.1.10 of @advanced-rest-client/base and version 17.0.9 of arc-electron.
Affected products
- Advanced REST Client arc-electron < 17.0.9
Timeline
- 2022-03-02: disclosed
- 2022-03-03: patched: Version 17.0.9 patches the vulnerability