1319986 - Changeset parameter manipulation in https://bugherder.mozilla.org/

Status: RESOLVED INVALID

(Tree Management :: Bugherder, defect)

Description

[Sebastien Morin]

Attachment: Normal TIP

Hi,

I've found that you can manipulate the changeset parameter in https://bugherder.mozilla.org/ resulting in different steps and information accessible.

Description:
---------------

When visiting https://bugherder.mozilla.org/, you have to enter an URL or changeset ID or just "tip". When trying to fetch information/data by inserting tip, I only have access to limited action/information (See Normal_TIP.png). However, if I intercept the request and insert  square brackets [] in the parameter changeset name which will send an array object, I have access to more action/information (See Crafted_TIP.png).

Impact:
---------

This is clearly an abnormal reaction of the application which lead to more action/information for the users.

Step-by-step Reproduction Instructions:
----------------------------------------------

1. Go to the following address: https://bugherder.mozilla.org/
2. Enter tip in the changeid parameter.
3. Set up a proxy to capture the GET request.
4. Click on submit.
5. Change the "changeset=tip" parameter to "changeset[]=tip" (See Changeid.png)
6. Confirm the abnormal reaction of the application.

Please let me know if you have any questions.

Best regards,
Sébastien Morin

Comment 1

[Sebastien Morin]

Attachment: Crafted_TIP

Comment 2

[Sebastien Morin]

Attachment: Changeid

Comment 3

[Simon Bennetts [:psiinon]]

Thats only a problem if changing the parameters gives access to data you shouldnt otherwise see.
No idea if thats the case here but I'll aim to find someone who does know.

Comment 4

[Simon Bennetts [:psiinon]]

wkocher - can you answer that question?

Comment 5

[Ed Morley [:emorley]]

Bugherder (unrelated to Treeherder) is a client-side only JS app, that uses the public hg.mozilla.org API to access push information. 

I can't see a security issue here?

Comment 6

[Ed Morley [:emorley]]

The STR in comment 0 involve manually modifying the app's client-side requests. Unless similar requests can be triggered by passing a specially crafted set of query parameters to a Bugherder page, then this report isn't really about Bugherder, but instead about crafted API calls to the public hg.mozilla.org (which can be made outside of Bugherder).

Using that logic to simplify the report in comment 0, turns it into something like:


"""
STR:
1) Make a request to 'https://hg.mozilla.org/mozilla-central/json-pushes/?full=1&changeset=tip'
2) Make a request to 'https://hg.mozilla.org/mozilla-central/json-pushes/?full=1&changeset[]=tip'

Expected:
Response is the same.

Actual:
The response differs.
"""

However:
(a) It's not expected that the responses are the same. 
(b) Even if it were, the json-pushes feature of hg.mozilla.org is a public API, so there's no secrets to be gained.

What's happening in the #2 case is that `changeset[]` is an invalid parameter, so is ignored. The API is then just returning the same response as:
'https://hg.mozilla.org/mozilla-central/json-pushes/?full=1'
...which is just to return the last ten pushes:
https://hg.mozilla.org/hgcustom/version-control-tools/file/6298a2195598/hgext/pushlog-legacy/pushlog-feed.py#l295

For improved UX of consumers of the API it might be desirable to make invalid parameters cause an error rather than be silently ignored, but that's not a security issue. (Though that would have to be weighed against backwards compatibility, in case there are existing clients using deprecated parameters.)

Comment 7

[Simon Bennetts [:psiinon]]

Thanks Ed :)

Comment 8

[Sebastien Morin]

Thank you for the well detailed explanation! 

I was not 100% sure about this one, but I just wanted to be sure if it would not lead in any case to a security issue.

Sorry I didn't want to waste your time.

Comment 9

[Simon Bennetts [:psiinon]]

Not a problem - we'd rather people report potential problems like this that keep quiet because they are not sure :)

Comment 10

[Sebastien Morin]

Good to know that you guys care about security!! :)