Flaws in Belgium’s Connective eID extension exposed

James Arnott, founder of Bay Area Labs, disclosed security flaws in Connective, a browser extension developed by Nitro Software Belgium and used by more than two million people in Belgium. The extension is deployed by eight of the country’s ten largest banks and by over 60 government agencies to enable digital identity authentication and legally binding electronic signatures.

Arnott found the extension did not verify which website initiated communication. Missing origin checks allowed any webpage or embedded advertisement to interact with the Connective application on a user’s machine without consent. A malicious page could read data from a connected electronic ID (eID) or payment card.

Web pages could present authentication dialog boxes with custom text while the extension omitted the requesting domain. Attackers could display official-looking prompts to trick users into entering their eID PINs. When a PIN was entered into such a prompt, the application transmitted the PIN back to the requesting webpage. With a stolen PIN and a victim’s physical eID card inserted in a reader, an attacker could generate approval tokens and create forged electronic signatures that carry legal weight under Belgian systems.

Services that rely on eID signatures for account registration or identity actions can be affected even if those services have no direct vulnerability. Examples include government portals such as CSAM.be and identity applications such as Itsme.

Arnott also identified a separate remote code execution flaw that worked whether or not an eID card was present. A flaw in how the application processed local files could allow a malicious website to cause the software to execute attacker-controlled code at the user level. The attack could be triggered by getting a user to download a file disguised as a document and then visiting a webpage. Because the exploit required no elevated permissions, it could be used to send malicious links from compromised accounts to other users.

Nitro Software Belgium patched the issues 146 days after Arnott’s initial report and awarded a $200 bug bounty. The company deployed updates to block unauthorized origin requests and to change how PINs are handled, and it reported that final security enforcement was completed in late July. No Common Vulnerabilities and Exposures identifiers appear to have been assigned. Nitro did not respond to requests for comment.

Arnott presented the findings publicly at DEF CON and published a technical blog post with detailed attack scenarios and proof-of-concept descriptions.