338523 - XSS with XPCNativeWrapper(window).Function(...)

Status: RESOLVED FIXED

(Core :: Security, defect, P1)

Description

[shutdown]

XPCNativeWrapper(window).Function(...) allows one to
create a function that can be used for XSS attacks.

Comment 1

[shutdown]

Attachment: testcase

works on:
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.1a2)
  Gecko/20060518 BonEcho/2.0a2
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.0.4)
  Gecko/20060518 Firefox/1.5.0.4

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

I think I have this mostly figured out. I'm too jetlagged at the moment to explain more, but it has to do with XPCNativeWrappers causing the outer window's Function to be found instead of the inner one's. I'll have details and hopefully a patch tomorrow.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: wip

With this patch, standard classes don't resolve at all through XPCNativeWrappers. I'll work on that soon.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

> With this patch, standard classes don't resolve at all through
> XPCNativeWrappers.

The problem is simply that I need to define the resolved property on the rewrapped obj2 for things to work. I'll probably have a patch tomorrow or Monday.

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Hackable patch

This patch goes half-way. I realized that it isn't sufficient, since it will happily return a content-supplied Function to unsuspecting XPCNativeWrapper(window) users.

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: No standard classes from XPCNativeWrapper

So, jst and I talked about this a bunch, and came to the conclusion that getting standard classes out of XPCNativeWrappers is unsupported and shouldn't be allowed. If you need to create a function or string in a content context from chrome, the preferred way (after this patch) will be to use w.eval(...) instead.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 226409 [details] [diff] [review]
No standard classes from XPCNativeWrapper

Looks reasonable, yeah.

Comment 8

[Johnny Stenback (:jst)]

Comment on attachment 226409 [details] [diff] [review]
No standard classes from XPCNativeWrapper

r=jst

Comment 9

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into trunk.

Comment 10

[Daniel Veditz [:dveditz]]

Comment on attachment 226409 [details] [diff] [review]
No standard classes from XPCNativeWrapper

approved for 1.8.0 branch, a=dveditz for drivers

Comment 11

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into the 1.8.0 branch.

Comment 12

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into the 1.8 branch.

Comment 13

[Jay Patel [:jay]]

v.fixed on 1.8.0 branch with Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US;
rv:1.8.0.5) Gecko/20060626 Firefox/1.5.0.5, no exploit with testcase:

XPCNativeWrapper(window).Function is not a function
attachment.cgi?id... (line 11)
anonymous

Comment 14

[Daniel Veditz [:dveditz]]

Not needed for moz1.7 or aviary branches, XPCNativeWrapper() not available.

Comment 15

[chris hofmann]

pvnick is doing a bit of research on XSS and also gathering up bugs with security related test cases to help add to the regression/certification test suites.  adding him to the cc list in these...