Плагин ГИС НР

ID: cdjkkeofanojcdolaakkckkmfcjejlij

Could be malicious

Supported Languages

🇷🇺Russian

Extension Info & Metadata

Status
Removed
Version
2.10
Size
0.82 MB
Rating
1.8/5
Reviews
26
Users
200,000
Type
Extension
Updated
Oct 9, 2024
Category
Make_chrome_yours Accessibility
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
No

Publisher Contextual Analysis

Author
esepextView Profile
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Total Extensions
1
Active
0
Obsolete
1
Listed
1
Unlisted
0
Total Users
200,000

Расширение предназначено для видеофиксации действий, осуществляемых на электронных площадках и на сайте ЕИС.

Расширение является встраиваемым в браузер модулем (плагином) и предназначено для выполнения функций по сбору, протоколированию, обработке и хранению данных из информационных систем, используемых в процессе проведения электронных процедур и заключения контрактов на электронных площадках и ЕИС. Плагин ГИС НР позволяет защитить права участников контрактной системы в ходе проведения электронных процедур с помощью встроенного видеоплеера. Пользователь имеет возможность зафиксировать нарушение и/или ошибку, произошедшую на электронной площадке и/или официальном сайте ЕИС, включив запись своей работы на площадке. Записанное видео может быть направлено в ФАС или иной орган в качестве подтверждающих материалов. Важно: фиксации подлежит полный экран компьютера пользователя, включая панель задач и системное время. Во избежание недоразумений во время работы модуля не следует демонстрировать на экране вашего компьютера информацию личного характера, не имеющую отношения к работе на электронной площадке, ЕИС и Официальном сайте торгов.

Item
Type
Severity
Description
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
webRequest
Permission
Critical
This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
<all_urls>
Host
Critical
Broad host access — the extension can read/modify content on every website.
Broad Host Permissions
Risk Factor
High
This extension has broad host permissions allowing it to access many or all websites.
Broad Content Script Access
Risk Factor
High
This extension can inject scripts into any website.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
activeTab
Permission
Medium
This permission grants temporary access to the current tab. Rated Medium because it can access current page content when invoked, though limited to user-initiated actions.
tabs
Permission
Medium
This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
http://127.0.0.1:9822/*
Host
Medium
Host permission — access limited to this URL pattern.
alarms
Permission
Low
This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.
notifications
Permission
Low
This permission displays system notifications. Rated Low because it can only show user-visible notifications without accessing system data.

This registers global `webRequest` listeners for every top-level HTTP/HTTPS navigation and records the visited URL, timing, and error/status outcome. That is broad browsing telemetry collection across `<all_urls>`, then forwarded to the companion service, which is a strong unauthorized-data-collection and network-observation pattern.

js/background/monitors/request-monitor.js (Line 38)
webRequest()  .onBeforeRequest.addListener(function(details) {    if (details.type != 'main_frame' || details.url.indexOf("127.0.0.1") == 0)      return;    requestMap['' + details.requestId] = new Date()      .getTime();  }, urlFilter, []);webRequest()  .onCompleted.addListener(function(details) {    if (details.type != 'main_frame' || details.url.indexOf("127.0.0.1") == 0)      return;    var time = getTime(details.requestId);    sendSetMarketplaceState(details.url, time, (details.statusCode < 200 || details.statusCode >= 300), details      .statusCode);  }, urlFilter, []);if (webRequest()  .onErrorOccurred)  webRequest()  .onErrorOccurred.addListener(function(details) {    if (details.type != 'main_frame' || details.error == 'net::ERR_ABORTED')      return;    var time = getTime(details.requestId);    time = 60 * 1000 + 1;    var status = details.statusCode;    if (!status)      status = 503;    sendSetMarketplaceState(details.url, time, true, status);  }, urlFilter, []);

The extension captures the active tab URL and page title, stores them locally, and immediately sends them to the local companion process. Combined with the `<all_urls>` content and tab access, this enables continuous page-level activity tracking beyond the extension's own UI.

js/background/monitors/activ-page-monitor.js (Line 3)
async function sendActivPageUrl(url, title) {  await allInitPromise;  if (storage.settings && (storage.activUrl != url || storage.activPageTitle != title)) {    storage.activUrl = url;    storage.activPageTitle = title;    saveStorage();    var data = {      'cmd': 'SetActivePage',      'params': {        'url': url,        'title': title      }    };    sendRequestToServer(data)      .then(response => {        getStatus();      })      .catch(error => {});  }}

Because this content script runs on `<all_urls>`, any page script that knows the hardcoded secret can query whether the extension is installed and receive plugin/VPN status details. That exposes an extension fingerprinting surface to arbitrary websites and leaks local environment state back into the page context.

js/contentScripts/content-script.js (Line 7)
window.addEventListener("message", function(event) {      if (event.data.secret_key &&        (event.data.secret_key === "gisnr_secret_key") &&        event.data.source === "page") {        if (event.data.type) {          switch (event.data.type) {            case 'is_extension_installed':              window.postMessage({                source: "content_script",                type: 'extension_installed',                secret_key: "gisnr_secret_key",                pluginAvailable: pluginAvailable,                kupolEnabled: kupolEnabled,                version: version,                vpnState: vpnState,                vpnServer: vpnServer              }, "*");              break;

This service worker forcibly injects code into arbitrary open tabs solely to keep itself alive, using `chrome.scripting.executeScript` over a wildcard URL set. The injected code is minimal, but the pattern is still broad code execution in user pages and expands the extension's effective reach beyond ordinary event-driven behavior.

js/background/keepalive.js (Line 4)
async function keepAlive() {  if (lifeline) return;  for (const tab of await chrome.tabs.query({      url: '*://*/*'    })) {    try {      await chrome.scripting.executeScript({        target: {          tabId: tab.id        },        func: () => {          chrome.runtime.connect({            name: 'keepAlive'          });          console.log('keepAlive');        },      });      chrome.tabs.onUpdated.removeListener(retryOnTabUpdate);      return;    } catch (e) {}  }  chrome.tabs.onUpdated.addListener(retryOnTabUpdate);}

By severity

Critical1
High4
Medium6
Low0

Versions scanned

Showing 2 of 9 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
2.104
2.47

Files with findings

6 distinct paths — top paths by unique finding count:

  • js/background/monitors/request-monitor.js3
  • js/background/controllers/background-controller.js2
  • js/background/monitors/activ-page-monitor.js2
  • js/contentScripts/content-script.js2
  • js/background/keepalive.js1
  • js/background/services/command-service.js1
S.No.
Category
Severity
File
Summary
Found in Version
1Unauthorized Data Collection
critical
js/background/monitors/request-monitor.js (line 7)The extension registers a blocking `webRequest` listener against ALL http and https URLs (`http://*/*` and `https://*/*`), intercepts every main-frame navigation, and exfiltrates the full URL, precise load timing, and…
2Network Interception
high
js/background/monitors/request-monitor.js (line 38)This registers global `webRequest` listeners for every top-level HTTP/HTTPS navigation and records the visited URL, timing, and error/status outcome. That is broad browsing telemetry collection across `<all_urls>`, th…
3Network Interception
high
js/background/monitors/request-monitor.js (line 52)The `onBeforeRequest` listener is registered with the `blocking` extra-info spec, meaning the extension can delay or modify every outgoing HTTP/HTTPS request across all websites. Combined with the universal URL filter…
4Tracking
high
js/background/monitors/activ-page-monitor.js (line 6)Every tab activation, tab update, and browser window focus change triggers extraction of the active tab's full URL and page title, which are then transmitted to the local server. This creates a continuous real-time lo…
5Unauthorized Data Collection
high
js/background/monitors/activ-page-monitor.js (line 3)The extension captures the active tab URL and page title, stores them locally, and immediately sends them to the local companion process. Combined with the `<all_urls>` content and tab access, this enables continuous …
6Code Injection
medium
js/background/keepalive.js (line 4)This service worker forcibly injects code into arbitrary open tabs solely to keep itself alive, using `chrome.scripting.executeScript` over a wildcard URL set. The injected code is minimal, but the pattern is still br…
7Other
medium
js/background/controllers/background-controller.js (line 91)The extension exposes its runtime status and version to any external page matching `*://localhost/*` via `chrome.runtime.onMessageExternal`. Any locally-served web application can query the extension's running state a…
8Tracking
medium
js/contentScripts/content-script.js (line 7)Because this content script runs on `<all_urls>`, any page script that knows the hardcoded secret can query whether the extension is installed and receive plugin/VPN status details. That exposes an extension fingerpri…
9Tracking
medium
js/background/controllers/background-controller.js (line 217)A `PostTelemetry` command that includes the user's current active URL is sent to the local server whenever internet connectivity state, time synchronization state, or marketplace availability changes. This constitutes…
10Tracking
medium
js/contentScripts/content-script.js (line 1)The content script, injected into ALL frames of ALL URLs, listens for `window.postMessage` from any origin and responds using the hardcoded plaintext secret `"gisnr_secret_key"`. Because the secret is embedded in the …
11Tracking
medium
js/background/services/command-service.js (line 13)A unique GUID is generated at service initialization time and appended as `id` to every command sent to the local server. This GUID persists for the lifetime of the background page and acts as a stable per-session ide…
URLs
140
IPv4
1
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

disk.yandex.ru-https://disk.yandex.ru
www.w3.org/TR/html4/loose.dtdhttp://www.w3.org/TR/html4/loose.dtd
zakupki.gov.ru/epz/main/public/document/view.htmlhttps://zakupki.gov.ru/epz/main/public/document/view.html?sectionId=920
www.w3.org/1999/02/22-rdf-syntax-nshttp://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com/xap/1.0/http://ns.adobe.com/xap/1.0/
purl.org/dc/elements/1.1/http://purl.org/dc/elements/1.1/
ns.adobe.com/photoshop/1.0/http://ns.adobe.com/photoshop/1.0/
ns.adobe.com/xap/1.0/mm/http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com/xap/1.0/sType/ResourceEventhttp://ns.adobe.com/xap/1.0/sType/ResourceEvent#
ns.adobe.com/xap/1.0/sType/ResourceRefhttp://ns.adobe.com/xap/1.0/sType/ResourceRef#
Showing 1 to 10 of 140 rows
Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

127.0.0.1
IPv4
-
Showing 1 to 9 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.