1335688 - Cross-Site Printing (XSP) and CORS Spoofing

Status: NEW

(Core :: Networking, defect, P3)

Description

[Jens Müller]

User Agent: Mozilla/5.0 (X11; Linux i686; rv:38.0) Gecko/20100101 Firefox/38.0 Iceweasel/38.3.0
Build ID: 20150923064158

Steps to reproduce:

Using `cross-site printing' (= cross-protocol request to port 9100 of a network printer), it is possible to perform attacks against intranet printers using the web browser as carrier. This issue has already been demonstrated in 2007 by Aaron Weaver to send printer spam or even to update the firmware for specific models.

A new version of the attack has lately been published, which allows malicious websites to bypass the same-origin policy and access data on the device by making the printer respond with a valid HTTP header including `Access-Control-Allow-Origin: *' using PostScript echo commands. A detailed description of this `CORS spoofing' technique can be found here: http://hacking-printers.net/wiki/index.php/Cross-site_printing

Proof-of-concept code which uses WebRTC to obtain the victim's local IP address and quickly enumerate printers in the LAN can be found here: http://hacking-printers.net/xsp/


Actual results:

XSP in combination with CORS spoofing allows a web attacker to capture printed documents, obtain passwords stored on the device etc. Various attacks are documented here: http://hacking-printers.net/


Expected results:

This is not a bug in Firefox, but based on the abuse of legimtimate web features and standards (XHR, CORS, WebRTC).

A solution/workaroud would be to to add port 9100 to the list of blocked ports: https://developer.mozilla.org/en-US/docs/Mozilla/Mozilla_Port_Blocking

Or maybe even disallow internet based websites to access intranet addresses at all by denying all requests from external to internal resources (at least if they use the private address spaces defined in RFC1918)? I can't think any websites it would break.

Comment 1

[Frederik Braun [:freddy]]

If the solution is to block port 9100, then the bug should live in Core/Networking.
I tend to agree, but we'd need to figure out how common port 9100 is  for legitimate HTTP-ish applications and if we would block something useful.

Comment 2

[Valentin Gosu [:valentin] (he/him)]

Assigning it to Patrick. Hopefully we can tackle this together with bug 1299881

Comment 3

[Frederik Braun [:freddy]]

:evilpies pointed out there is bugzilla history attached to it, which I suppose this is interesting for the original reporter. That being said, we should re-evaluate the blocking and should *not* take the wontfix from previous bugs!

Comment 4

[Tom S]

Attachment: Block port 9100 used for Cross-Site Printing.

Comment 5

[Tom S]

If we wanted to fix this sooner we could set network.security.ports.banned for our users with an extension or in a new release.

Comment 6

[Patrick McManus [:mcmanus]]

Comment on attachment 8834431 [details] [diff] [review]
Block port 9100 used for Cross-Site Printing.

Review of attachment 8834431 [details] [diff] [review]:
-----------------------------------------------------------------

please track chrome's landing of this and coordinate.

The general external can't connect to internal approach has exhibited tons of breakage in the past; fwiw

Comment 7

[Tom S]

Chrome's Intent to Deprecate and Remove:
https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/Ttkgd4aPkW0/7Uwd-S16BwAJ

They want to add some port usage information to telemetry, maybe we should do that as well.

Comment 8

[Tom S]

I wonder what Google is doing, can somebody ping them?

Comment 9

[Frederik Braun [:freddy]]

I've asked again in blink-dev.

Comment 10

[Boris Zbarsky [:bzbarsky]]

Note https://groups.google.com/a/chromium.org/d/msg/blink-dev/Ttkgd4aPkW0/Mxt0JprqBAAJ

Comment 11

[Tom S]

I wonder if Chrome is even still going to do this.

Comment 12

[Firefox Bug Husbandry Bot]

Bulk priority update: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258

Comment 13

[Tom S]

I am not actively keeping up-to-date on this, unassigning myself.

Comment 14

[Anne (:annevk)]

Reducing priority given that Chrome never shipped this and it likely breaks sites per comment 10. We should block some other additional ports, but that's probably best tracked separately from 9100.