Browser Extension potential Private Network Access issues
This is just a proactive report, most likely something y'all have already mitigated or is a non-issue for browser extensions.
I noticed that the RDM browser extension will make requests such as http://localhost:19443/api/v2/get-* to get various bits of data from the RDM client for use within the browser extension. I recently came across various articles that state that browsers are starting to enforce something called PNA (private network access), which would prevent public sites to access private/local resources (i.e. the RDM client in this case). This very well may be a non-issue when in a browser extension context, but either way I just wanted to mention it in case it does have some sort of effect down the road for y'all. As it stands today, I don't see any issue in the current release of Chrome and using y'alls browser extension. If issues do develop, then looks like one option would be to return a pre-flight header of Access-Control-Allow-Private-Network: true.
Reference these links for some details:
https://developer.chrome.com/blog/private-network-access-preflight
https://chromestatus.com/feature/5436853517811712
https://www.oligo.security/blog/0-0-0-0-day-exploiting-localhost-apis-from-the-browser
https://wicg.github.io/private-network-access/
Hector
All Comments (5)
Hi,
Thank you for feedback. We already have some users that cannot use localhost for various reasons. In such cases, we recommend utilizing Native Messaging to establish communication between the browser extension and Remote Desktop Manager. You can find more details about this solution in our documentation here: Native Messaging Guide.
Best regards,
Olivier Désalliers
Hello,
I tried enabling native messaging per that doc, and while I can get the browser extension to connect to the RDM client and list credentials, clicking on one of them will NOT autofill into the user/password input fields. Luckily the HTTP listener still works and DOES properly autofill the creds, but curiously this one part doesn't work when native messaging is enabled. Any idea?
FYI, to anyone who comes across this and wonders what exactly "native messaging" is (like I did), since RDM docs don't really explain it too well, this seems to be a browser feature that allows web apps to communicate directly to external apps w/o relying on HTTP calls. So you wont see any logs in dev tools network trace, but rather the data is sent over these chrome back-channel APIs which are forwarded to a registered RDM program (follow regkey to `..\Devolutions\Remote Desktop Manager\RemoteDesktopManager.NativeMessagingHost.exe`). See here for more details: https://developer.chrome.com/docs/extensions/develop/concepts/native-messaging
Example flow: chrome.runtime.sendNativeMessage("com.devolutions.rdmnativemessaging", msg, callbackFn) > Chrome back-channel API > RemoteDesktopManager.NativeMessagingHost.exe > RDM IPC Channel?
Hector
Hi,
Could you please let us know the following details to assist you better?
• Which version of RDM are you currently using?
• What browser are you using (e.g., Chrome, Firefox, Edge, etc.)?
• Does this issue occur across all your data sources and websites, regardless of how the credentials are configured (e.g., Username/Password, linked, inherited, etc.)?
We’ll attempt to reproduce the issue on our end.
Best regards,
Olivier Désalliers
RDM: 2023.2.14.0
Edge & Chrome (131.0.6778.267)
The types I've tested were for "Website" entry where the credentials are "Linked (Vault)". I also just tested a "Website (Legacy)" entry where the credentials are "Find by name (User Vault)" as well as one with the credentials hardcoded into the connection entry, with same exact results. Disabling native messaging so that the HTTP listener is used would allow credentials to be filled in as expected.
I know our RDM version is quite out-of-date now, so if it does happen to be something about the older version causing issues, please just confirm that you tested it as working in the latest version (w/ HTTP listener disabled and native messaging enabled).
Hi,
We were able to reproduce your issue using RDM 2023.2.14.0. If you’d like to avoid two major releases (2024.X and 2025.X) that might require database update, RDM 2025.1 will be the next major release and is set to be released pretty soon.
Best regards,
Olivier Désalliers