1175425 - UniversalXSS in Quick Translator add-on (raw translation inserted using innerHTML)

Status: RESOLVED FIXED

(addons.mozilla.org :: Security, defect)

Description

[Daniel Veditz [:dveditz]]

The Security alias received a report from Diaa (@dia2diab) that the Quick Translator add-on is vulnerable to a Universal XSS because the translation is inserted into its panel using innerHTML (much like the problem with another translation add-on in bug 976945)

https://addons.mozilla.org/en-US/firefox/addon/quick-translator/

It appears you'd have to have the user select text in an <input> or <textarea> (the POC uses <input>) and translate only the selected text rather than the entire page, but with that limitation I confirmed the bug. (I can't rule out the possibility of being able to booby-trap the regular text in an HTML doc, but my simpleminded variations on the POC didn't work).

An example test page: http://diaa.alwaysdata.net/POC.php

source of POC:
  <center>
    <input type="text" value="<img src=d onerror=prompt('Hacked')>">
  <center>

Comment 1

[Kris Maglione [:kmag]]

It doesn't matter where the text is. If it's translating a selection, the add-on sends the text of the selection, without escaping any HTML metacharacters, and injects whatever text Google Translate returns, without in any way sanitizing it.

It also requests the translation over HTTP, includes the option of automatically translating text whenever the selection changes, and interacts with content documents entirely via non-X-ray wrappers, including attaching a property to the content window global with several bound methods (which are fortunately not accessible to content in recent versions of Firefox).

So, all-in-all, this is pretty worrying. The add-on has a quarter of a million users, and appears entirely unmaintained, so we may have to block. I'll try contacting them via AMO and give them a week to respond.

Comment 2

[Daniel Veditz [:dveditz]]

Oh sorry, yes. I did mean to mention the worrying warnings about unsafe CPOW usage. The functionality is nice (nicer than the one I'm using) but the implementation is a disaster.

Comment 3

[Daniel Veditz [:dveditz]]

Kris: did you ever hear back? We probably need to block this now.

Comment 4

[Kris Maglione [:kmag]]

I haven't heard back. I disabled the AMO listing. The blocklisting question is up to Jorge.

Comment 5

[Jorge Villalobos [:jorgev] (he/him)]

Does version 2.0a1 have the same vulnerabilities? It's a big rewrite, supposedly, and pushing that version to users (if it works) would be preferable over blocking it.

Comment 6

[Kris Maglione [:kmag]]

It looks like it's been completely rewritten from an overlay extension to an SDK extension, but I don't have the time to go through the code at the moment.

Comment 7

[Jorge Villalobos [:jorgev] (he/him)]

Version 2.0a1 looks much better and the POC doesn't work on it. I'm approving it so current users will be updated to it. I'll block the older versions in two weeks, to give users time to update.

Comment 8

[Jorge Villalobos [:jorgev] (he/him)]

The developer decided to hide the extension on AMO. It's unclear if they intend to submit new versions in the future.

All vulnerable versions are now blocked:

https://addons.mozilla.org/blocked/i966

Comment 9

[Madalin Cotetiu]

Please add STR here or mark it with [qa-] if no QA is needed.

Comment 10

[Mathieu Agopian [:magopian]]

I think it's qa-, the faulty add-on has been blocklisted.

Comment 11

[Carsten]

We are working on a new version, based on 1.0: https://github.com/CodeKullen/QT. Did not know that 2.0a1 was released - found it - we will check the differences.