423541 - (CVE-2008-2805) Arbitrary file upload via originalTarget and DOM Range

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect, P2)

Description

[Samuel Sidler (old account; do not CC)]

Attachment: Testcase

As reported to security@ by Opera:

While investigating potential file upload issues, one of our security
researchers came across another vulnerability in Firefox.  This is
unrelated to the issues that we have previously reported to you.
Attached.  Exploiting the issue only requires one click (anywhere in the
page), and one keypress (a-z, 0-9...any typed character works, although
ctrl/shift/backspace/etc don't work).


Filing in DOM:HTML since that's where bug 413135 was filed.

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

Jst, could we add a check to nsDOMClassInfo: if cx doesn't have system principal
and .originalTarget is in native anonymous then return .target as 
.originalTarget.

Comment 2

[Johnny Stenback (:jst)]

Could we not do that in the originalTarget getter implementation instead? 

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

But some native code which runs when there is content cx in stack may need
the right originalTarget.

Comment 4

[Johnny Stenback (:jst)]

Then such code should push null on the JS context stack while calling code that depend on the context stack.

Comment 5

[Damon Sicore (:damons)]

Can we get a security rating on this? 

Comment 6

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Does this really work on trunk? Getting references to the internal objects really shouldn't be able to get you anywhere on trunk.

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

I can't reproduce this on trunk, but can on 1.8.
Samuel, you added the blocking1.9? Can you reproduce this on trunk?

Comment 8

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Based on previous comment removing blocking.

*Definitely* renominate if this can be reproduced on trunk though!

Comment 9

[Samuel Sidler (old account; do not CC)]

(In reply to comment #7)
> Samuel, you added the blocking1.9? Can you reproduce this on trunk?

Apologies. That was a kneejerk reaction. I can't reproduce on trunk.

Comment 10

[Samuel Sidler (old account; do not CC)]

-> Olli since he fixed bug 413135.

Comment 11

[Olli Pettay [:smaug][[e-mail]]]

Attachment: possible patch

I'll do still some testing but I think this might be good enough.

Comment 12

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 319352 [details] [diff] [review]
possible patch

I can't think any easier way to fix this. event.originalTarget isn't the only way to get access to native anon content.

I know it sucks to put nsContentUtils::IsCallerTrustedForCapability("UniversalFileRead") to nsRange, but are there any other options?

Comment 13

[Johnny Stenback (:jst)]

Comment on attachment 319352 [details] [diff] [review]
possible patch

Seems reasonable for branch to me.

Comment 14

[Olli Pettay [:smaug][[e-mail]]]

Jonas, could you perhaps sr this?

Comment 15

[Daniel Veditz [:dveditz]]

Comment on attachment 319352 [details] [diff] [review]
possible patch

Approved for 1.8.1.15, a=dveditz for release-drivers

Comment 16

[Al Billings [:abillings - ex-MoCo]]

Verified for 1.8.1.15 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.15pre) Gecko/2008061004 BonEcho/2.0.0.15pre.

Comment 17

[Alexander Sack]

Comment on attachment 319352 [details] [diff] [review]
possible patch

a=asac for 1.8.0