Is OpenText Documentum Client Manager safe?
OpenText Documentum is medium risk. A Documentum page's bridge event makes the content script forward its attributes to the background script, which reads tab cookies and forwards them to the native app. Not seen on ordinary sites; needs the Documentum-specific event.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Documentum bridge forwards tab cookies to native app
A Documentum page's bridge event makes the content script forward its attributes to the background script, which reads tab cookies and forwards them to the native app.
Not seen on ordinary sites; needs the Documentum-specific event.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You use a Documentum enterprise page that sends the extension bridge event.
The content script checks for Documentum D2, Webtop, xCP, or eRoom page markers before inserting its bridge element.
The extension reads cookies for that tab and forwards the cookie names and values to the native Documentum application.
Testing on ordinary websites did not observe this cookie access without the Documentum page event.
- Cookie names and valuesJSESSIONID=9F2C4D6E8A1B0C3D (illustrative)
This can include session cookies for the site open in your current tab, which may identify your signed-in browsing session.
- Page originhttps://d2.documentum.example.corp (illustrative)
This ties the bridge message to the website origin where you were working.
- Bridge event nameemc.ctf.ctfBridgeConnect (illustrative)
This shows which Documentum page event caused the extension to send a message.
- Native application selectorcom.opentext.documentum.client.0.0.1.7 (illustrative)
This tells the extension which native application connection receives the message.
- Browser tab identifier218 (illustrative)
This lets responses from the native application be routed back to the tab you were using.
During dynamic analysis, browsing common non-Documentum websites did not trigger cookie collection or extension-originated network requests across 446 captured requests. The code path shown here requires a Documentum client page to dispatch the bridge event before the background script reads cookies.
The bridge event becomes a native-app message that includes tab cookies
Deobfuscated content script: same bridge-event forwarding path
deobfuscated/contentScript.jsfunction prepareMessagePayload(event) { var eventType = event.type; console.log("caught the " + eventType + " in Content Script."); var messagePayload = { eventType: eventType }; var allAttributes = event.target.attributes; messagePayload['origin'] = window.location.origin; for (var i = 0, n = allAttributes.length; i < n; i++) { var attribute = allAttributes[i]; if (attribute.name !== null && attribute.value !== null) { messagePayload[attribute.name] = attribute.value; } } return messagePayload;}function informBackgroundPage(event){ var messagePayload = prepareMessagePayload(event); chrome.runtime.sendMessage(messagePayload);}insertExtensionElementIfOpenTextApp();var handshakeEventID = "emc.ctf.ctfBridgeConnect";window.informBackgroundPage = informBackgroundPage;listenToEvent(handshakeEventID, informBackgroundPage);dispatchEvent({'eventID': 'emc.ctf.addonInited', "action": "dispatchEvent", "data": {"targetelementname": "addonInited"}});chrome.runtime.onMessage.addListener(handleResponse);Deobfuscated background script: same cookie collection and native-message send
deobfuscated/background.jschrome.runtime.onMessage.addListener(function(request, sender, sendResponse) { console.log(request.app_name); if(sender.tab && request && request.eventType && request.app_name) { chrome.cookies.getAll({url: sender.tab.url}, function(cookies){ request.tabId = sender.tab.id; request.cookies = {}; for( var i = 0; i < cookies.length; i++){ var currentCookie = cookies[i]; var cookieName = currentCookie.name; request.cookies[cookieName] = currentCookie.value; } var daemon = getDaemon(request); if (daemon !== null){ daemon.postMessage(request); } }); } });function getDaemon(request){ var appName = request['app_name'] + "." + request['app_version']; console.log(appName); var portObj = portsMap[appName]; if(!portObj){ portsMap[appName] = portObj = {connectCount: 0, port: null} } if (portObj.port === null) { try{ portObj.port = chrome.runtime.connectNative(appName); portObj.nativePortDisconnected = false; portObj.port.onDisconnect.addListener(function() { var nativePortDisconnectedReason = chrome.runtime.lastError.message; console.log("Content Transfer daemon exited, reason: " + nativePortDisconnectedReason); if(nativeAppNotInstalled(nativePortDisconnectedReason)){ installNativeApplication(request); } portObj.nativePortDisconnected = true; portObj.port = null; }); portObj.port.onMessage.addListener(function(message) { console.debug(message); if(message && message.tabId){ chrome.tabs.sendMessage(message.tabId, message); } }); portsMap[appName] = portObj; } catch(e){ console.log(e); } } portsMap[appName].connectCount++; return portsMap[appName].port; }What it can do
Permissions this extension asks for, as declared in version 0.0.1.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
http://*/*
Read and change your data on every secure site you visit
https://*/*
Run its own code inside the pages you visit
scripting
See the address and title of every tab you have open
tabs
Start, monitor and manage your downloads
downloads
Read and change cookies, including the ones that keep you signed in
cookies
Talk to a program installed on your computer, outside the browser's sandbox
nativeMessaging
Act on the current tab, but only after you click the extension
activeTab