1614468 - (CVE-2020-12392) 'Copy As Curl' in the network panel of the devtools uses '--data' instead of '--data-raw', leading to arbitrary local file access

Status: RESOLVED FIXED

(DevTools :: Netmonitor, task, P2)

Description

[Ophir LOJKINE]

Attachment: bug.html

After the discussion about the patch for bug 1607742, I made a few more experiments with the "Copy as curl" functionality, and found another vulnerability : POST data is sent using '--data' instead of '--data-raw'. This means that if the body of an HTTP request starts with the character '@', the rest of the body will be interpreted as a file name to send instead of raw data.

An attacker can use this bug to read local files on the computer of an user of the "Copy as curl" functionality. The only thing he has to do is making a request such as the following :

fetch('', {body: '@/etc/passwd', method:'POST'})

When the user will use 'copy as curl' on the generated request, and then execute the curl command, the contents of /etc/passwd will be send to the attacker's server.

Fixing this bug is as simple as using --data-raw instead of --data.

Comment 1

[Jan Honza Odvarko [:Honza] (always need-info? me)]

Ophir, interested in fixing this one?
Honza

Comment 2

[Ophir LOJKINE]

I really like contributing to free software, but after looking at the instructions for the devtools (https://docs.firefox-dev.tools/getting-started/build.html), I feel like it's not worth pulling gigabytes of dependencies, including several compilers, for just a 1-line javascript fix. So I'll have to decline the offer.
It would be nice if the Firefox dev tools could be decoupled from Firefox itself, just like the chrome dev tools: https://github.com/ChromeDevTools/devtools-frontend

Comment 3

[Ophir LOJKINE]

Yes, the reporter of the chromium bug is also me. The bug existed in both browsers, and opened two independent bugs.

Comment 4

[:Gijs (he/him)]

Attachment: Bug 1614468, r?Honza

Comment 5

[:Gijs (he/him)]

sec-moderate so landing without sec-approval:

https://hg.mozilla.org/integration/autoland/rev/a8704ad66a0bbd00f4285af2c11cd0891edc4101

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/a8704ad66a0b

Comment 7

[:Gijs (he/him)]

Sec-bug with a trivial fix, so I'm assuming we can uplift this. bomsy, do you agree?

Comment 8

[Hubert Boma Manilla (:bomsy)]

yes i do thanks!

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Please nominate this for Beta and ESR68 approval when you get a chance. It grafts cleanly to both as-landed.

Comment 10

[:Gijs (he/him)]

Comment on attachment 9140819 [details]
Bug 1614468, r?Honza

Beta/Release Uplift Approval Request

• User impact if declined: sec bug in curl handling in devtools
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce: n/a
• List of other uplifts needed: n/a
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Basically find/replace for the curl command, fixing a security issue that happens based on how curl interprets the data provided to a commandline argument
• String changes made/needed: none

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: sec-moderate issue
• User impact if declined: sec bug in curl handling in devtools
• Fix Landed on Version: 77 uplifted to 76
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Basically find/replace for the curl command, fixing a security issue that happens based on how curl interprets the data provided to a commandline argument
• String or UUID changes made by this patch: none

Comment 11

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9140819 [details]
Bug 1614468, r?Honza

Approved for 76.0b6 and 68.6esr.

Comment 12

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #11)

Comment on attachment 9140819 [details]
Bug 1614468, r?Honza

Approved for 76.0b6 and 68.6esr.

That should be (only) 68.8esr?

Comment 13

[Ryan VanderMeulen [:RyanVM]]

Yes, typo.

Comment 14

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/releases/mozilla-beta/rev/0be5d26d7c21832f481d3303788f4445c8c97ca0
https://hg.mozilla.org/releases/mozilla-esr68/rev/8a69499311707d0f1b65be875217e7aed7dad2ae

Comment 15

[Frederik Braun [:freddy]]

Attachment: advisory.txt