VALTEC アイパスフリー
ID: plbjcbdpbhfggpeognlbannjefdfgcbh
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- kikakuView Profile
- Privacy
- Privacy Policy
- Help
- Help Center
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
パスワードレスログイン用拡張アプリ。利用には登録が必要です。
シングルサインオン用拡張アプリです。利用登録することでWEBサービスのID、パスワード、コストを管理。Windows Hello対応PCをお使いであれば生体認証でログインすることが可能になります。
This extension requests no permissions and has no recorded risk factors.
Plaintext credentials for a real user account (username '14038', password 'hmorimoto14038') are hardcoded in commented-out code within the production extension bundle, targeting two third-party URLs (cloud.mot-net.com and smc00.webjapan.co.jp). While not active in this version, their presence in the distributed bundle exposes real credentials to anyone with access to the CRX, and demonstrates the developer previously used this extension to directly auto-fill hardcoded credentials into arbitrary third-party login forms without any SSO authentication. A future version could silently uncomment this code or introduce similar hardcoded fills for other users.
/*var mot_cloud = 'https://cloud.mot-net.com/default.aspx'var smc00_url = 'http://smc00.webjapan.co.jp/newmcsys/index.jsp'var now_url = location.hrefvar ref_url = document.referrerif(now_url.startsWith(mot_cloud) && !(ref_url.startsWith(mot_cloud))){ document.getElementsByName('txtID')[0].value = "0999002"; document.getElementsByName('txtUserID')[0].value = "14038"; document.getElementsByName('txtPassword')[0].value = "hmorimoto14038"; //document.getElementById('imgbtnLogin').submit(); //document.forms[0].submit();}if(now_url.startsWith(smc00_url)){ document.getElementsByName('UserID')[0].value = "14038"; document.getElementsByName('Password')[0].value = "hmorimoto14038"; //document.forms[0].submit();}*/By severity
Versions scanned
None of the 1 scanned version has more than one unique code-review finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| No versions with multiple unique findings. | |
Files with findings
1 distinct path — top paths by unique finding count:
- content/auth/script/main.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.