The MetaMask Demonic Vulnerability Explained

Video transcript

Demonic was not a hack. It let browsers save a MetaMask recovery phrase to disk, in plain text.

Halborn disclosed it on June 15, 2022. It said MetaMask, Brave, Phantom and xDefi were affected, and all had remediated it.

To support Restore Session, Firefox and Chromium save non-password input fields to disk, unencrypted. MetaMask took the phrase in an input field. The saved phrase could even survive an uninstall.

Halborn named three conditions: an unencrypted drive, a phrase imported on a device the user no longer has or a compromised one, and Show Secret Recovery Phrase ticked. Attackers also needed disk access.

MetaMask's fix, in version ten point eleven point three, used one password-type field per word, revealing one at a time. It shipped almost three months before disclosure.

Halborn called Demonic critical. NVD scores it 5.9, Medium, with high attack complexity. Neither Halborn nor BleepingComputer reported a loss.

The extension did not write the phrase to disk. The browser did. So reviewing only the wallet's storage code could miss it.

Halborn's advice works as a test list: one field per word, confirm by selecting words, clear phrase variables and block pasting. Then check session restore and autofill after restart and uninstall.

Guardian's Browser Extension Pentest covers six areas, starting with key and session storage. Read the full article, or talk to Guardian at guardian.security.

Demonic was not a hack. It was a way a wallet's recovery phrase could end up on disk, in plain text, outside the wallet's control.

The flaw sat between the extension and the browser. That makes it a useful case for any team that ships a wallet extension.

Here is what Halborn disclosed, how the flaw worked, how MetaMask fixed it and what it shows about testing key and session storage.

What Happened

On June 15, 2022, Halborn's security research team disclosed a vulnerability it code-named Demonic. It "can expose a crypto wallet user's secret recovery phrase," Halborn wrote.

The phrase can in turn be used to reconstruct the user's private key, Halborn noted.

Halborn said the affected wallets included MetaMask, Brave, Phantom and xDefi, "who have remediated the issue." It kept the details private until it had made a good faith effort to reach the wallet providers.

BleepingComputer reported that Halborn found the flaw in September 2021.

The NVD record, CVE-2022-32969, names only MetaMask, in versions before 10.11.3. It was published on June 29, 2022.

How the Attack Worked

Browsers can reopen a session after a crash or restart. To support this "Restore Session" feature, Firefox and Chromium browsers save non-password input fields to disk, unencrypted, Halborn explained.

MetaMask took the recovery phrase in an input field, NVD's description says. So the browser could store the phrase on disk "in plain text," in Halborn's words.

What an attacker needed

Halborn said the risk was present if all three conditions were met:

• The hard drive was unencrypted.
• The phrase was imported on a device the user no longer has, or one that is compromised.
• The user ticked "Show Secret Recovery Phrase" to view the phrase during import.

The attacker also needed remote or physical access to the disk. BleepingComputer named a remote access trojan as one route.

Per Halborn, the phrase could survive a system restart and the removal of the extension. An attacker with the user's permissions or more might also read it from memory.

The fix

MetaMask 10.11.3 split the recovery phrase input into one field per word, its changelog says. GitHub shows the release on March 22, 2022.

The pull request behind it sets out the design. Each word uses a password-type field, and only one word can be revealed at a time.

That shipped almost three months before Halborn's public disclosure. BleepingComputer reported that Phantom fixed the flaw in April 2022, and xDefi in version 13.3.8.

Timeline and Impact

Halborn called Demonic a critical vulnerability. NVD scores it 5.9, Medium, under CVSS 3.1, rating attack complexity high and confidentiality impact high.

"Users who entered their seed phrase in Metamask 10.11.2 and earlier may be at risk," Halborn wrote. It advised users who believe they may be affected to "migrate to a new set of accounts."

Halborn gave no count of affected users. Neither it nor BleepingComputer reported a loss.

What It Shows

The extension did not write the phrase to disk. The browser did, to support a convenience feature.

So a review limited to the wallet's own storage code could miss it. The test has to cover what the browser keeps around the extension.

Halborn's advice to wallet teams reads as a test list:

• Split the phrase into one field per word, with one revealed at a time.
• Confirm the phrase by selecting words, not retyping it.
• Clear variables holding the phrase so memory is freed sooner.
• Keep the raw phrase out of the page, for example by drawing it on a canvas.
• Block pasting into phrase fields, and warn users about the clipboard.

Testers can add the browser's side. Check session restore, autofill and form caches after a restart and an uninstall, on each supported browser.

Storage is one surface. Malicious updates are another, as the Cyberhaven extension attack showed. Our browser extension pentest guide walks through every review area.

How Guardian Tests Extensions

Guardian's Browser Extension Pentest starts from one premise: "An extension holds keys and sits between the user and every signature."

It tests what a hostile site can extract and what a bad update could do. The page lists six areas:

• Key and session storage: where keys, seeds and tokens live, how they are encrypted, and what is readable while unlocked.
• Permissions and manifest: what the extension can reach, and how far a malicious version could go.
• Content scripts: what gets injected into every page, and what a hostile site can reach through it.
• Internal messaging: whether a page can hit a privileged handler.
• Signing flows: whether the signed payload matches what the user approved.
• Supply chain: bundled dependencies, build integrity and who can publish a store update.

Source code is effectively required, the page says: a store download cannot confirm every path was reviewed. See all of Guardian's offchain pentests.

Frequently Asked Questions

What is the MetaMask Demonic vulnerability?

It is CVE-2022-32969, disclosed by Halborn on June 15, 2022. In MetaMask before 10.11.3, a recovery phrase typed into an input field could be saved to disk in plain text by the Restore Session feature in Firefox and Chromium browsers.

Was any crypto stolen through Demonic?

Neither Halborn nor BleepingComputer reported any theft. An attacker needed remote or physical access to the device, an unencrypted disk, and a phrase imported with "Show Secret Recovery Phrase" ticked.

Which wallets were affected by Demonic?

Halborn said affected wallets included MetaMask, Brave, Phantom and xDefi, all of which had remediated it. The NVD record covers MetaMask before 10.11.3. BleepingComputer reported Phantom's fix in April 2022 and xDefi's in version 13.3.8.

What should users who may have been affected do?

Halborn advised users who believe they may be affected to migrate to a new set of accounts, following MetaMask's instructions. It notes that disk encryption mitigates the on-disk exposure, and a hardware wallet can add protection.

Sources

• NVD: CVE-2022-32969 Detail (published June 29, 2022)
• Halborn: Halborn MetaMask "Demonic" Vulnerability Discovery (June 15, 2022)
• Halborn: Halborn Discovers Critical Vulnerability Affecting Crypto Wallet Browser Extensions (June 15, 2022)
• BleepingComputer: MetaMask, Phantom warn of flaw that could steal your crypto wallets (June 16, 2022)
• MetaMask on GitHub: Version 10.11.3 release (March 22, 2022)
• MetaMask on GitHub: Pull request #14016, Split SRP input by word (merged March 21, 2022)
• Guardian: Browser Extension Pentest