Chrome Logger Information Disclosure

medium Web App Scanning Plugin ID 113951

Language:

Synopsis

Description

Chrome Logger is a Google Chrome extension used to debug server side applications in the Chrome console. By installing the extension in their Chrome browser and a server-side library on their application, developers can retrieve the configured debug information directly in Chrome.

As Chrome Logger works by transmitting server data to the client through response HTTP headers `X-ChromePhp-Data` or `X-ChromeLogger-Data` using base64 encoding, an attacker could retrieve any sensitive data logged with Chrome Logger and leverage it to conduct further attacks.

Solution

Ensure that the application does not use Chrome Logger in production. If needed, do not include sensitive information in the logs and enforce permissions to allow only authorized users to read it.