Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Audit and Remediation: Failed To Read manifest.json Error When Querying Browser Extensions

Audit and Remediation: Failed To Read manifest.json Error When Querying Browser Extensions

Environment

  • Carbon Black Cloud Console: All Versions
  • Carbon Black Cloud Windows Sensor: All Supported Versions

Symptoms

Issuing a Live Query for a list of installed browser extensions returns no matched results for a single endpoint, only an error similar to:
Failed to read the following manifest.json file: C:\Path\To\manifest.json. The extension was referenced by the following profile: C:\Users\Username\AppData\Local\Publisher\Browser\User Data\Default

Cause

  • The specified manifest file is missing, corrupt, or unreadable, which causes osquery to return this error.
  • Upon receiving this error, the Sensor aborts the query altogether and no matched results are collected.

Resolution

  • This issue is being tracked under EA-23689 and expected to be addressed in a future Sensor release with the resolution of DSEN-26565 by no longer aborting the query when this non-critical error is received.
  • In the meantime, no known workarounds exist on machines where a manifest.json file cannot be read, other than restoring the referenced file.

Additional Notes

  • Every extension requires a JSON-formatted file containing basic metadata about the extension, including name and version details.
  • Systems with no unreadable manifest files are expected to return matched results in Live Query for any installed extension that fit the query criteria.
  • Earliest expectations on a pending fix should be the 4.1 Sensor in Q1 2024.

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎11-16-2023
Views:
80
Contributors