1196014 - HTML injection in WiFi remote debugger prompt

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Gaia::System, defect)

Description

[Julian Hector [:tedd] [:jhector]]

Attachment: JS script to trigger injection

A HTML injection can be triggered when the device prompts[1] the user for accepting a remote debugging connection over WiFi.

I file this bug as a precaution, because I only triggered the vulnerability using WebIDE and attaching onto the phone, I don't know if this can be triggered by setting the hostname of the debugging device to contain the injection. (I couldn't get the remote WiFi debugging working).

But I could imagine that the device gets the hostname from the debugging device based on what the debugging device reports to the network. Whereas the |port| I don't think it is possible to embed an injection string there.

I tested this on the latest flame-l build (20150818204622)

Attached is the script used to trigger the injection.

[1] https://github.com/mozilla-b2g/gaia/blob/ccc131052b5818287cb94db9211861aedbb9bfc9/apps/system/locales/system.en-US.properties#L473

Comment 1

[Julian Hector [:tedd] [:jhector]]

Attachment: PoC screenshot

Comment 2

[Julian Hector [:tedd] [:jhector]]

I did some further investigation and I don't think an attacker can control |host|, I believe it is just the IP from the debugging device. I got a little lost in the code.

Comment 3

[Christiane Ruetten [INACTIVE]]

This is another instance of .innerHTML in localization, see bug 1027117. Wondering if this is perhaps connected to the sanitation bug 1190038. Perhaps :stas does know more?

Comment 4

[Staś Małolepszy :stas]

We removed that particular use of .innerHTML in bug 1027117.  This should now be correctly santized by the l10n.js lib.  :tedd, can you test your PoC again with a more recent version of Gaia, please?

Comment 5

[Julian Hector [:tedd] [:jhector]]

:stas, I tried it with a newer gaia version (commit 5bceb2f8de6a62bed39ff8a13e21a02f04e3d45d) and it is fixed.

I think we can close the bug, what do you think?

Comment 6

[Staś Małolepszy :stas]

Sounds like this was successfully fixed by bug 1027117.  Marking as such.