ZenHub for GitHub Enterprise

The background service worker exposes a 'code' message command that passes the raw message data directly into chrome.scripting.executeScript as a code string. This is an explicit arbitrary remote code execution channel — any content script (or a page that can spoof a message to the extension) can dispatch a string of JavaScript and have it executed by the privileged service worker. While Manifest V3 removed the `code` property from executeScript, the design intent is a persistent RCE backdoor and the handler remains active in the message router.

code(data, sender, sendResponse) {  chrome.scripting.executeScript(null, {    code: data,  });  sendResponse({    status: 'OK',  });},

The service worker exposes a general-purpose HTTP proxy that accepts an arbitrary URL, HTTP method, request headers, and body from message senders with no URL validation or allowlist. Because the service worker holds host_permissions for both https://zenhub.ibm.com/api/* and https://github.ibm.com/*, a compromised or injected content script can route authenticated API calls (including calls carrying the user's GitHub session cookies) through this proxy to either permitted domain, enabling credential-bearing data exfiltration to the ZenHub backend or lateral movement against the IBM GitHub API.

executeXMLHttpRequestInBackground: async (data, sender, senderResponse) => {  const [method, url] = data.open;  const [body] = data.send; // body of the request  const requestHeaders = data.setRequestHeader; // Array<{key: string, value: string}>  const formattedRequestHeaders = requestHeaders?.reduce(    (acc, {      key,      value    }) => ({      ...acc,      [key]: value,    }), {}  );  const response = await fetch(url, {    method,    headers: formattedRequestHeaders,    body,  });  const contentType = response.headers.get('content-type') || '';  let responseHeaders = '';  for (const [key, value] of response.headers.entries()) {    responseHeaders += `${key}: ${value}\n`;  }  const formattedResponse = {    readyState: 4,    responseText: contentType.includes('application/json') ?      JSON.stringify(await response.json()) : await response.text(),    status: response.status,    statusText: response.statusText,    responseHeaders,  };  senderResponse(formattedResponse);},

The VideoEmbed template (listed as a web_accessible_resource available to https://github.ibm.com/*) reads a URL directly from the query string and assigns it to an iframe src without any validation, sanitization, or origin allowlist. An attacker who can craft a link on github.ibm.com can load chrome-extension://…/templates/VideoEmbed.html?url=https://attacker.com/phishing inside a full-viewport extension page, providing a highly credible phishing surface dressed in the extension's trusted origin. JavaScript URLs (javascript:…) are also not filtered.

const iframe = document.getElementById('externalVideo');const url = decodeURIComponent(window.location.search.replace('?url=', ''));iframe.src = url;

The service worker pushes every connecting port named 'waitForOAuth' into a shared array without verifying the sender's origin or tab. Any content script running on the permitted github.ibm.com origin can connect with this port name and receive the oauthSuccessFromPort notification, leaking the timing and occurrence of user authentication events to potentially untrusted scripts and enabling session-timing attacks.

chrome.runtime.onConnect.addListener((port) => {  if (port.name === 'waitForOAuth') oAuthListenerPorts.push(port);});