1295023 - (CVE-2017-5387) Ability to determine the existence of a file in the local filesystem

Status: RESOLVED FIXED

(Core :: Audio/Video: Playback, defect)

Description

[Mustafa Hasan (strukt)]

Attachment: ff-file-enumeration.html

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Build ID: 20160802213348

Steps to reproduce:

The issue exists because a <track> tag's onerror event is triggered twice if the file referenced in it's src attribute doesn't exist, while it's only triggered once if the file exists but not playable.

Please check the attached file for a PoC. Change the path to the file in the src attribute in the <track> tag for the different behaviors explained.


Actual results:

The onerror event for the <track> tag is fired twice if the file doesn't exist and once if it does.


Expected results:

The onerror event should be fired the same number of times for both cases.

Comment 1

[:Gijs (he/him)]

Rillian, can you or someone else who's worked on this code look at this?

Comment 2

[Ralph Giles (:rillian)]

Alastor, can you take a look at this please?

Comment 3

[Daniel Veditz [:dveditz]]

This works as a local attack only--that is, when the PoC is itself loaded from a file:/// url. From a web page you always get a "doesn't exist" result because there's a security error thrown:

Security Error: Content at https://bug1295023.bmoattachments.org/attachment.cgi?id=8780916 may not load or link to file:///etc/passwd.

Comment 4

[Alastor Wu [:alwu]]

Sure, I will check it later.

Comment 5

[Mustafa Hasan (strukt)]

Excuse me, but why is this case considered sec-low, while the bug described here http://leucosite.com/FireFox-Check-If-Local-File-Folder-Exists-Using-Jar-URI-Scheme/ is about the same class of issues, and even the POC itself has to be loaded via the file:// protocol, yet it was considered sec-moderate and was even rewarded a bounty ?

Comment 6

[Alastor Wu [:alwu]]

Attachment: Bug 1295023 - ignore to set the same value for the ready state.

Review commit: https://reviewboard.mozilla.org/r/72578/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/72578/

Comment 7

[Ralph Giles (:rillian)]

Comment on attachment 8782394 [details]
Bug 1295023 - ignore to set the same value for the ready state.

https://reviewboard.mozilla.org/r/72578/#review70330

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/305892e22d9c
ignore to set the same value for the ready state. r=rillian

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/305892e22d9c