# Missing Line Terminator on allowedOrigins enables origin spoofing

Missing regex terminator in MetaMask Snaps allowedOrigins let a malicious domain spoof an allowed origin and reach restricted Snaps APIs like Keyring exportAccount.

- Payout: hidden
- Severity: high
- Program: MetaMask
- Found by: pkkr
- Disclosed: 2024-10-29
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2585855
- Library page: https://bugbountylibrary.com/r/h1%3A2585855
- Tags: area:web3 domain:web3 impact:data-leak kind:bounty platform:hackerone sev:high tech:evm technique:source-review vuln:access-control vuln:auth-bypass

**Target:** Snaps allowedOrigins origin allowlist / Snaps API
**Root cause:** The allowedOrigins regex lacked a line terminator/anchor, so a crafted origin string could match the allowlist pattern without being the exact allowed origin.
**Steps:**
1. Configure a Snap with an allowedOrigins entry (e.g. `https://trusted.example`).
2. Craft a malicious origin whose string matches the unanchored regex, e.g. `https://trusted.example.attacker.tld` or a newline-suffixed variant.
3. Load a malicious dApp from that origin and call restricted Snaps APIs.
4. Invoke Keyring API `exportAccount` to retrieve sensitive account data.
**How found:** Researcher inspected the allowedOrigins regex-based origin control and noticed the missing terminator/anchor, hypothesizing that origin strings could be crafted to match without being the exact allowed origin.
**Exploitation:** Malicious dApp served from a spoofed origin bypasses allowedOrigins check and calls restricted Snaps API methods, including Keyring exportAccount, to extract sensitive account information from Snaps implementing it.
**Insight:** When an allowlist is enforced with a regex rather than exact string comparison, check for missing anchors/terminators (^, $, \z) and test whether attacker-controlled suffixes or newlines still match.