293424 - Malicious website can access chrome

Status: RESOLVED FIXED

(Core :: Security: CAPS, defect)

Description

[Paul Nickerson]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3

The url "about:" can be accessed by a website, but it takes some cross site 
scripting (using another vuln submitted by me) to javascript:document.write
(""); onto the about: page to show its true url 
(chrome://global/content/about.xhtml). From there, the page is treated under 
chrome priviledges and system access is easy.

Reproducible: Always

Steps to Reproduce:
1. http://greyhatsecurity.org/secretfoldervulns/about.htm
2. Click the link
3. Wait about 2 seconds
Actual Results:  
Script executed in chrome

Expected Results:  
about: page navigation from internet pages should be disallowed

Comment 1

[Mike Connor [:mconnor]]

Testcase doesn't work in my current build, but linking to about: seems to be a
bad thing in general.

Comment 2

[Mike Connor [:mconnor]]

Attachment: block about: from chrome

I can't think of anything this would break...

We should think about the "about:foo points to chrome" concept as a potential
attack vector in general.  Shaver's suggestion was to deprivillege about:
completely, moving about:config and friends requiring chrome access to
system:*, and possibly blocking any linking to these URLs.  What's left in
about: should not have chrome URLs or any privs at all.

But for the branch, we can just flip this off, the others seem to be safe, for
now (and in about 5 minutes, someone will prove me wrong I'm sure).

Comment 3

[Jay Patel [:jay]]

Brendan:  Can you review the patches and give the a= so we can get this checked
in soon?  Thanks.

Comment 4

[Brendan Eich [:brendan]]

Comment on attachment 186337 [details] [diff] [review]
block about: from chrome

Yeah, let's go.  This is overdue.

/be

Comment 5

[Jay Patel [:jay]]

Comment on attachment 186337 [details] [diff] [review]
block about: from chrome

We want this on the branch too. a=jay

Comment 6

[timeless]

i seem to recall having a patch which we backed out that let documents retain
their proper url instead of having them morph :(

Comment 7

[Jay Patel [:jay]]

Updated product/component per timeless. Since this is core, we should probably
get this in 1.7.9 also, right?  Nominating...

Comment 8

[Mike Connor [:mconnor]]

checked in to aviary/1.7/trunk

Comment 9

[Jay Patel [:jay]]

v.fixed on aviary with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.9)
Gecko/20050706 Firefox/1.0.5 using original testcase.  about: cannot be loaded.

Comment 10

[Daniel Veditz [:dveditz]]

Adding distributors

Comment 11

[Daniel Veditz [:dveditz]]

FF1.0.5 advisories published