Skip to content

v0.3.4 - Security Update: Browser Daemon

Choose a tag to compare

View all tags
@rashid-brd rashid-brd released this 12 Aug 20:03
· 1 commit to main since this release
v0.3.4
0005249

🔒 Security Update: Browser Daemon Hardening

This patch release addresses a high-severity security report regarding the local browser daemon's TCP listener, specifically affecting Windows environments. We highly recommend all users update to this version.

🛡️ Security Fixes

  • Local Hijack Prevention (Token Auth): The local daemon now generates a 256-bit cryptographic token on startup (stored in a strictly permissioned .token file). All IPC requests must be authenticated, preventing unauthorized local processes from controlling the browser session.
  • Web Drive-By Protection: Implemented protocol-level sniffing on the daemon's socket. The server now immediately drops traffic starting with standard HTTP verbs (e.g., POST, GET). This completely neutralizes cross-origin drive-by attacks via web browsers (fetch()).
  • Arbitrary File Write Fix: The screenshot command execution is now securely jailed to its base directory on the server side, blocking path traversal (../) and null-byte injections.
    • Note for users: CLI behavior remains fully backward-compatible. Absolute paths still work perfectly, as the file-writing logic was safely moved to the CLI client.

🐛 Additional Hardening & Bug Fixes

  • Memory Exhaustion (DoS): Enforced a 1MB payload limit (MAX_REQUEST_BYTES) on the daemon's IPC socket to prevent potential memory exhaustion attacks.
  • Tests: Improved cross-platform test reliability for local configuration file generation and isolated test environments.

Special thanks to MichaelSha (security@brightdata.com) for responsibly reporting these vulnerabilities and assisting with the remediation.

Assets 2
Loading