1036213 - (CVE-2014-1546) [SECURITY] Add '/**/' before jsonrpc.cgi callback to avoid swf content type sniff vulnerability

Status: RESOLVED FIXED

(Bugzilla :: WebService, defect)

Description

[Mario Gomes]

Attachment: poc.html

User Agent: Mozilla/5.0 (X11; Linux i686 (x86_64)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

Steps to reproduce:

Hi,

I think you may already know about this vulnerability(no, take a look - miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/)

this vulnerability allows the page jsonrpc.cgi as a swf file then resulting in http request in local webserver(bugzilla.mozilla.org). To patch that add '/**/' before the callback function.

Reproduce:
1. Log in bugzilla.
2. open poc.html(attached)
3. wait 10 seconds
4. you will be redirected to a page that contains the source code of 'bugzilla.mozilla.org'(was got via victim browser) so it contains your session security token.

Cheers,

Comment 1

[Mario Gomes]

btw, i am only able to reproduce on firefox.

Comment 2

[Simon Green]

Can you reproduce this in a version 4.0 or above? This bug is marked Bugzilla 3.6, which has EOLed.

Comment 3

[Mario Gomes]

Yeah, sorry about that. I am able to reproduce it +4.0.

Comment 4

[Reed Loden [:reed]]

Attachment: patch - v1

Comment 5

[Reed Loden [:reed]]

(In reply to Mario Gomes from comment #1)
> btw, i am only able to reproduce on firefox.

Chrome and Opera aren't affected, as we send the |X-Content-Type-Options: nosniff| header with every response.

Comment 6

[Mario Gomes]

Yeah - As both are based on webkit both are safe.

Comment 7

[Simon Green]

The code goes all the way back to Bugzilla 4.0 ( http://git.mozilla.org/?p=bugzilla/bugzilla.git;a=blob;f=Bugzilla/WebService/Server/JSONRPC.pm;h=5ee341b4b11b38ffb951ed60721af6cc6afd4df6;hb=refs/heads/4.0#l91 [github] ). Released version have an extra new line before the closing brace which means a different patch it required for those branches.

Comment 8

[Simon Green]

Attachment: Patch for released versions of Bugzilla.

Comment 9

[Daniel Veditz [:dveditz]]

Could we also add an arbitrary length limitation on the callback name? More than 32 characters? Learn to be more concise -- status 500 for you.

Comment 10

[Daniel Veditz [:dveditz]]

Hold off on using that CVE until I get an answer from MITRE. It's possible we should just say we're fixing our version of the main CVE-2014-4671 that covers the original vulnerability. That would conflict with their policy that fixing the same bug in different client libraries need separate CVEs, but then I'm not sure what CVE-2014-4671 would cover because the primary blog post was about a technique, not a specific vulnerable software.

Comment 11

[Jesse Ruderman]

Using "nosniff" seems like the more principled approach. Why doesn't it work in Firefox? Is there a bug on that?

Comment 12

[Daniel Veditz [:dveditz]]

My first instinct was right, we need our own CVE for bugzilla.

Comment 13

[Daniel Veditz [:dveditz]]

(In reply to Jesse Ruderman from comment #11)
> Using "nosniff" seems like the more principled approach. Why doesn't it work
> in Firefox? Is there a bug on that?

Bug 471020

Comment 14

[Mario Gomes]

Is this bug eligible for a bounty?

Comment 16

[Daniel Veditz [:dveditz]]

glob: is there a separate bug for pushing this to BMO? Has that happened yet?

Comment 17

[Mario Gomes]

Thank you so much for the bounty ! :)

Comment 18

[Simon Green]

(In reply to Daniel Veditz [:dveditz] from comment #16)
> glob: is there a separate bug for pushing this to BMO? Has that happened yet?

Bug 1036281 , and yes, it has gone live. BRC was also updated last week too.

Comment 19

[Mario Gomes]

btw, couldnt get the bounty payment due that the banking informations used in the payment was a old one(my old bank account). Dont know why that happenned since i sent the right payment informations to `chris hoffman` told him that there were updates in my bank account but he/mozilla kept sending the payment to my old account that i don't have access anymore.

so, somebody responsable for bounty's payment can give me some explanation why'd it happend? also, could someone re-send the payment to the right payment informations that I provided?

Comment 20

[Frédéric Buclin]

FYI, we always set the version field of security bugs to the first release affected. In this specific case, the first release with this bug is Bugzilla 3.7.1, see bug 550727.

Comment 21

[David Lawrence [:dkl]]

To ssh://[e-mail]/bugzilla/bugzilla.git
   b3554b3..8498827  4.0 -> 4.0

To ssh://[e-mail]/bugzilla/bugzilla.git
   26728e3..f0760dd  4.2 -> 4.2

To ssh://[e-mail]/bugzilla/bugzilla.git
   5d24520..ac5bf59  4.4 -> 4.4

To ssh://[e-mail]/bugzilla/bugzilla.git
   cf3e8bc..02ce906  master -> master