Summary
Tldr
Through a publicly available data storage bucket, I was able to access sensitive information of all users using the web agent product MultiOn, which included screenshots of every website they have been on.
The Vulnerability
It is important to note that MultiOn’s Chrome extension is in beta, and as such, subject to issues before official release. Additionally, the terms of service clearly outline the risks involved with using the MultiOn service prior to its use.
The following issue was found while conducting research on the security analysis of web agents, together with Z. Berkay Celik and Arjun Arunasalam. My goal was to capture images MultiOn took on my browser as it ran to collect data on its performance. I experimented with various browser automation tools such as Selenium, which allowed me to open the Multion page and inject a script which takes screenshots every few seconds.
This would take quite a bit of time to implement, and since web agents run by taking screenshots of the page, I wondered if Multion stored images for me.
I noticed the following request upon opening Chrome dev tools to inspect the network logs as Multion was running:
I saw a POST request to https://s3.us-east-2.amazonaws.com/multion-client-screenshots. S3, or simple storage service, is AWS’s cloud storage solution, in which data is stored in buckets in the form of files. Upon creating an S3 bucket, an endpoint is generated to access this data. One use case for S3 is to host a static web application. This is achieved by storing the HTML/CSS/JavaScript which makes up the site.
By default, these buckets are not publicly accessible outside those authorized for its access.
I opened the MultiOn client screenshots endpoint in my browser and was presented with the following:
Instead, I was presented with the following:
This page is an XML file representing the different objects stored in Multion’s S3 data store. The “Key” parameter under content is an identifier for the image in the bucket.
By going to https://s3.us-east-2.amazonaws.com/multion-client-screenshots/<KEY> in my browser, I accessed a screenshot in the bucket. I was surprised to discover that rather this image was not an image that was captured in my Multion session. That is: the images within the S3 bucket were all the images captured during the session of any user who used Multion rather than just my own.
I confirmed the exposure with a local script, then inspected only enough redacted evidence to establish the impact.
The screenshots included privacy-sensitive data. As users may use MultiOn for filling out company spreadsheets, purchasing flights, and filling out forms, highly sensitive information, such as names, emails, passwords, calendar information, and bank account information could be gleaned from them.
Google Sheets spreadsheet with sensitive company information:
.png)
Flight status of a user:
The Fix
What I should be shown upon entering the multion-client-screenshots endpoint is as follows:
This ensures that I cannot view S3 bucket keys other than my own.
Additional Vulnerabilities
The rest of these issues don’t have as big a consequence as a publicly available S3 bucket, but nonetheless present a concern.
ElevenLabs API Key Exposed
ElevenLabs converts any text to speech in over 28 languages. MultiOn uses the ElevenLabs API to speak out loud the responses it generates.
I noticed that in the header was an x-api-key. I made a single request to the ElevenLabs API with this API key, and found that I could use the credits MultiOn purchased for ElevenLabs for my own projects. This would allow a user to use up any of the credits MultiOn purchased. A potential fix for this is to encrypt the API key, thereby replacing x-api-key with encrypted-x-api-key.
Uploading Unlimited Documents
You can upload unlimited documents to Multion’s cloud storage, allowing an attacker to overflow Multion’s storage bucket.
After every action, Multion sends a request to the following endpoint: https://multion-sdk-git-api-multion.vercel.app/api/upload_s3?<content>.
I noticed that I could upload any information to the bucket by changing that URL’s content.
There may be protections against uploading data on the server side (such as by limiting the number of uploads based on origin of the request). Still, it is important to ensure a malicious user cannot upload data to the bucket since this adds additional cost and overhead for Multion.
Actions taken
Upon collecting data and confirming the issue with the S3 bucket, I immediately informed the MultiOn team of the issue on their community Discord channel. Within the hour of my post, they immediately made the bucket secure by keeping it private. All additional vulnerabilities mentioned have also been fixed since the publishing of this post. However, it is still possible to access the screenshots in question if one has access to the keys (if the S3 bucket was scraped prior to it being made private).
Takeaway
Web agents collect a lot of information since they require either screenshots or underlying HTML content of every page a user visits to be able to perform actions on the page. There is a treasure trove of information within this data, making it all the more important to secure.
Software as a service (SAAS) products such as MultiOn store this sensitive data on cloud service providers such as Amazon Web Services to decrease operational costs while more easily scaling their product as users increase.
It is important for consumers and developers of these products to be aware of the highly sensitive nature of data stored. This is especially true for web agents, in which every screenshot of every webpage is stored as the agent completes its task. Proper security measures and consumer awareness of data leakage risks are of key importance as we head into a future with increasing amounts of AI products.