{"action":"opened","issue":{"url":"https://api.github.com/repos/bufferapp/buffer-extension-shared/issues/64","repository_url":"https://api.github.com/repos/bufferapp/buffer-extension-shared","labels_url":"https://api.github.com/repos/bufferapp/buffer-extension-shared/issues/64/labels{/name}","comments_url":"https://api.github.com/repos/bufferapp/buffer-extension-shared/issues/64/comments","events_url":"https://api.github.com/repos/bufferapp/buffer-extension-shared/issues/64/events","html_url":"https://github.com/bufferapp/buffer-extension-shared/issues/64","id":188537295,"number":64,"title":"[Suspected] Buffer Chrome Extension file vulnerability","user":{"login":"KoozaiDev","id":20998121,"avatar_url":"https://avatars.githubusercontent.com/u/20998121?v=3","gravatar_id":"","url":"https://api.github.com/users/KoozaiDev","html_url":"https://github.com/KoozaiDev","followers_url":"https://api.github.com/users/KoozaiDev/followers","following_url":"https://api.github.com/users/KoozaiDev/following{/other_user}","gists_url":"https://api.github.com/users/KoozaiDev/gists{/gist_id}","starred_url":"https://api.github.com/users/KoozaiDev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/KoozaiDev/subscriptions","organizations_url":"https://api.github.com/users/KoozaiDev/orgs","repos_url":"https://api.github.com/users/KoozaiDev/repos","events_url":"https://api.github.com/users/KoozaiDev/events{/privacy}","received_events_url":"https://api.github.com/users/KoozaiDev/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-11-10T15:25:45Z","updated_at":"2016-11-10T15:25:45Z","closed_at":null,"body":"Hi,\r\n\r\nI don't want to raise alarm bells, but i think you may have a vulnerability in a specific file: **buffer-hover-icon@1x.png**\r\n\r\nWe are noticing a number of users are seeing an injected iframe ad application being driven by a Russian collection of traffic generating sites and they all look to be using the following buffer extension file [buffer-hover-icon@1x.png] as they entry point.\r\n\r\nMaybe worth investigating?\r\n\r\n`<span id=\"buffer-extension-hover-button\" style=\"display: none;position: absolute;z-index: 8675309;width: 100px;height: 25px;background-image: url(chrome-extension://noojglkidnpfjbincgijbaiedldjfbhh/data/shared/img/**buffer-hover-icon@1x.png**);background-size: 100px 25px;opacity: 0.9;cursor: pointer;\"></span>`\r\n\r\nThis is the inner <iframe> being injected, and also not good as it renders the current URL which is not good to those not in the know.\r\n\r\nI have tracked down a number of URLs being used to run the application but there are many being used to relay the same output in case of one being closed down.\r\n\r\nso far i have traced them back to the following 2 sources, but time is not available to keep digging.\r\n\r\nReplacing that file should remove their entry point through your chrome extension.\r\n\r\n**Collected URLs:**\r\nhttp://rmbn.net/\r\nhttp://gnezdo.ru (Linked to a single individual located in Moscow)\r\nhttp://xlog.info/ (Hiding the embed frames content wrapper)\r\n http://tredman.com/  (Another frame holder generator)\r\n\r\nbut all pointing at the same file for entry point to inject their iframe for the ad engine.\r\n\r\nSee attached images for more details.\r\n\r\nHopefully we can resolve this vulnerability ASAP.\r\n\r\n![buffer vulnarbility - scenrio](https://cloud.githubusercontent.com/assets/20998121/20182501/e148c55e-a759-11e6-8c7b-1d8b3854f8a1.jpg)\r\n![buffer vulnarbility](https://cloud.githubusercontent.com/assets/20998121/20182500/e147972e-a759-11e6-9c57-5d09eab937d4.jpg)\r\n)\r\n\r\n"}}
{"actor":{"display_login":"KoozaiDev"}}