Is KiotViet safe?
KiotViet rewrites Facebook request headers and sends Messenger and GraphQL requests with scraped session tokens.
KiotViet sets Facebook Origin and Sec-Fetch-Site headers for Messenger, GraphQL, upload, and chat endpoints, then sends requests using scraped fb_dtsg and lsd session tokens. It also captures TikTok Live chat events on scoped live pages and forwards chat details such as comments and user identifiers to a caller-provided WebSocket.
Who publishes itKiotViet Technology Corporation - no other listings under this identity
KiotViet Technology Corporation - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
DNR rules rewrite Facebook headers for Messenger requests
Using KiotViet's Facebook messaging rewrites Origin and Sec-Fetch-Site headers on Messenger/GraphQL requests, sending session credentials to business.facebook.com, www.facebook.com, upload-business.facebook.com, and edge-chat.facebook.com.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
The user performs an action that uses KiotViet's Facebook messaging flow.
The extension rewrites Facebook Origin and Sec-Fetch-Site headers and posts Messenger GraphQL or send-message requests with Facebook session credentials.
- Facebook request headersOrigin: https://business.facebook.com
Origin and Sec-Fetch-Site headers can affect how Facebook classifies the request context.
- Facebook session credentialsfb_dtsg=ABC123... (illustrative)
Session token values identify an authenticated Facebook session for the outgoing Messenger or GraphQL request.
Where it sends data
Destinations our analysis observed KiotViet contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.facebook.comwidely used
KiotViet sends data to www.facebook.com. A widely used service: 29 other extensions we have analysed send data here.
- business.facebook.com
KiotViet sends data to business.facebook.com. No other extension we have analysed sends data here.
- edge-chat.facebook.com
KiotViet sends data to edge-chat.facebook.com. No other extension we have analysed sends data here.
- upload-business.facebook.com
KiotViet sends data to upload-business.facebook.com. No other extension we have analysed sends data here.