Summary During a manual source code review, ARIMLABS.AI researchers identified that the browseruse module includes an embedded whitelist functionality to restrict URLs that can be visited. This restriction is enforced during agent initialization. However, it was discovered that these measures can be bypassed, leading to severe security implications.

Details File: browseruse/browser/context.py

The BrowserContextConfig class defines an alloweddomains list, which is intended to limit accessible domains. This list is checked in the isurlallowed() method before navigation:

python @dataclass class BrowserContextConfig: """ [STRIPPED] """ cookiesfile: str | None = None minimumwaitpageloadtime: float = 0.5 waitfornetworkidlepageloadtime: float = 1 maximumwaitpageloadtime: float = 5 waitbetweenactions: float = 1

disablesecurity: bool = True

browserwindowsize: BrowserContextWindowSize = field(defaultfactory=lambda: {'width': 1280, 'height': 1100}) noviewport: Optional[bool] = None

saverecordingpath: str | None = None savedownloadspath: str | None = None tracepath: str | None = None locale: str | None = None useragent: str = ( 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36' )

highlightelements: bool = True viewportexpansion: int = 500 alloweddomains: list[str] | None = None includedynamicattributes: bool = True

forcekeepcontextalive: bool = False The isurlallowed() method is responsible for checking whether a given URL is permitted: python def isurlallowed(self, url: str) -> bool: """Check if a URL is allowed based on the whitelist configuration.""" if not self.config.alloweddomains: return True

try: from urllib.parse import urlparse

parsedurl = urlparse(url) domain = parsedurl.netloc.lower()

# Remove port number if present if ':' in domain: domain = domain.split(':')[0]

# Check if domain matches any allowed domain pattern return any( domain == alloweddomain.lower() or domain.endswith('.' + alloweddomain.lower()) for alloweddomain in self.config.alloweddomains ) except Exception as e: logger.error(f'Error checking URL allowlist: {str(e)}') return False The core issue stems from the line domain = domain.split(':')[0], which allows an attacker to manipulate basic authentication credentials by providing a username:password pair. By replacing the username with a whitelisted domain, the check can be bypassed, even though the actual domain remains different. Proof of Concept (PoC)

Set alloweddomains to ['example.com'] and use the following URL:

https://example.com:pass@localhost:8080

This allows bypassing all whitelist controls and accessing restricted internal services. Impact

- Affected all users relying on this functionality for security. - Potential for unauthorized enumeration of localhost services and internal networks. - Ability to bypass domain whitelisting, leading to unauthorized browsing.