1784348 - (CVE-2023-29539) Content-Disposition filename truncation leads to Reflected File Download

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect, P2)

Description

[Trung Pham]

User-Agent:
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:103.0) Gecko/20100101 Firefox/103.0
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0

When handling filename directive in the Content-Disposition header, the filename would be truncated if the token contains a NULL character and only the first part is kept: filename.exe<NULL>.txt -> filename.exe
This behavior makes Firefox users vulnerable to reflected file download (RFD). For instance, CVE-2022-36359[1] in Django that has been patched[2] is still exploitable on Firefox because the filename truncation provides a trivial way to manipulate and bypass extension checking/appending on the server side. These RFD vulnerabilities such as CVE-2022-36359, CVE-2015-5211[3] and CVE-2020-5398[4] in Spring Frameworks are all rated as High or Important in severity by the project maintainers.
More about RFD: https://securitylab.github.com/research/rfd-spring-mvc-CVE-2020-5398/

I know the vulnerability exists partly because Django allows invalid characters (RFC 2616 I suppose) in the filename. That said, this can only be addressed reliably from the client side. I believe it would be reasonable to stop accepting responses with invalid headers.

from django.shortcuts import render
from django.http import FileResponse

def index(request):
    filename = request.GET.get('filename') + ".pdf"
    print(filename)
    return FileResponse(open("/test.txt", 'rb'), as_attachment=True, filename=filename)

Given request.GET.get('filename') = file.cmd%00, Firefox would download the file file.cmd instead of file.cmd.pdf while Chromium and Safari threw an error (ERR_INVALID_HTTP_RESPONSE) and refused to open the page in this case.

Response:

HTTP/1.1 200 OK
Date: Thu, 11 Aug 2022 19:40:57 GMT
Server: WSGIServer/0.2 CPython/3.8.10
Content-Type: application/octet-stream
Content-Length: 3213
Content-Disposition: attachment; filename="file.cmd<NULL>.pdf"

[1] https://www.djangoproject.com/weblog/2022/aug/03/security-releases/
[2] https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173
[3] https://tanzu.vmware.com/security/cve-2015-5211
[4] https://tanzu.vmware.com/security/cve-2020-5398

Comment 1

[Daniel Veditz [:dveditz]]

The server shouldn't be sending these invalid headers, but we shouldn't be accepting them either. But then what? if we ignore the entire Content-Disposition header we could be making the site more vulnerable, because content-disposition can be a defense against hosting "active" web types. Reject the entire response? Delete the null and use the filename assuming it's not there?

Same may apply to other illegal-in-filename characters (especially control characters), but null is definitely a special problem.

Comment 2

[Dragana Damjanovic [:dragana]]

Valentin, can you take a look, I will not have time.

Comment 3

[Valentin Gosu [:valentin] (he/him)]

Chromium and Safari threw an error (ERR_INVALID_HTTP_RESPONSE) and refused to open the page in this case.

I think in this case we should try to align with the other browser engines.

Comment 4

[Sunil Mayya]

Attachment: Bug 1784348 - improve checks while parsing MIME parameters. r=#necko

Comment 5

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

improve checks while parsing MIME parameters. r=necko-reviewers,jesup,valentin
https://hg.mozilla.org/integration/autoland/rev/80d3ab95e4443d7a433517c1892063e1d4310b69
https://hg.mozilla.org/mozilla-central/rev/80d3ab95e444

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:smayya, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.Also, don't forget to request an uplift for the patches in the regression caused by this fix.
• If no, please set status-firefox112 to wontfix.

For more information, please visit auto_nag documentation.

Comment 7

[Sunil Mayya]

Comment on attachment 9322073 [details]
Bug 1784348 - improve checks while parsing MIME parameters. r=#necko

Beta/Release Uplift Approval Request

• User impact if declined: Users vulnerable reflected file download
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: Yes
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky):
• String changes made/needed:
• Is Android affected?: Yes

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration:
• User impact if declined: Users vulnerable to reflected file download
• Fix Landed on Version:
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The change checks for malformed strings (trailing characters past null) and do not introduce or modify any mime parsing algorithm

Comment 8

[Dianna Smith [:diannaS]]

:Sunil before uplifting this, is there any coordination/action that needs to happen due to the thunderbird regression attached (bug 1822377) ?

Comment 9

[Sunil Mayya]

I did not understand how this bug has lead to regression of bug 1822377.

Elizabeth, could you please clarify it for me please?
Feel free to guide us on any required coordination for uplift.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

I don't think much needs to happen here other than the TB folks backporting their bustage fix to comm-beta and comm-esr102 after we do the uplift on the Gecko side.

Comment 11

[Dianna Smith [:diannaS]]

Comment on attachment 9322073 [details]
Bug 1784348 - improve checks while parsing MIME parameters. r=#necko

Approved for 112.0b8

Comment 12

[Dianna Smith [:diannaS]]

https://hg.mozilla.org/releases/mozilla-beta/rev/8da8357cede9

Comment 13

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9322073 [details]
Bug 1784348 - improve checks while parsing MIME parameters. r=#necko

Approved for 102.10esr.

Comment 14

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr102/rev/c80e35e82cf9

Comment 15

[Tom Ritter [:tjr]]

Attachment: advisory.txt