290037 - Search plugins can get javascript access to currently active tab

Status: RESOLVED FIXED

(SeaMonkey :: Search, defect)

Description

[Michael Krax]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050408 Firefox/1.0.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050408 Firefox/1.0.3

By creating a special sherlock file it is possible to run javascript code in the
security context of the currently active tab. This allows to create search
engines that silently monitor all website displayed while searching (e.g. to
steal sessions cookies) and/or that wait for a privileged page (e.g. chrome or
about:config) to run arbitrary code.  


Reproducible: Always

Steps to Reproduce:
1. Open http://bugzilla:[e-mail]/firesearching/
2. Follow instructions



The demo adds a new search engine (called Firesearching) by calling
sidebar.addSearchEngine() that behaves like a normal Google search. When
searching with that engine an alert shows that the engine has javascript access
to the currently active tab. An attacker could silently send the information to
another host instead. 

When the currently displayed site is privileged (chrome or about:config) the
demo requests UniversalXPConnect rights, creates c:\booom.bat and launches the
batch file (shows a directoy listing in a dos box). This part is Windows only,
which is a limitation of the demo - the bug affects all platforms.

Comment 1

[Daniel Veditz [:dveditz]]

Attachment: search only intended to supports http -- make it so

Comment 2

[Ben Goodger (use ben at mozilla dot org for email)]

Comment on attachment 180510 [details] [diff] [review]
search only intended to supports http -- make it so

r=[e-mail]

Comment 3

[Asa Dotzler [:asa]]

Comment on attachment 180510 [details] [diff] [review]
search only intended to supports http -- make it so

a=asa

Comment 4

[Chase Phillips]

Comment on attachment 180510 [details] [diff] [review]
search only intended to supports http -- make it so

a=chase for branches

Comment 5

[Chase Phillips]

blocking1.7.7+

Comment 6

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

I'm not sure what "only HTTP" (vs., say, gopher or FTP) really means, but if you
think that's the right thing, sr=dbaron.

Comment 7

[Daniel Veditz [:dveditz]]

Fix checked in to trunk plus 1.7 and aviary branches

Comment 8

[Daniel Veditz [:dveditz]]

Fix released

Comment 9

[Daniel Veditz [:dveditz]]

Fix landed on trunk Apr 12 (see comment 7). FIXED.

Comment 10

[Juha-Matti Laurio]

This is SA14938's vulnerability #5; http://secunia.com/advisories/14938/ and
CAN-2005-1156 available at
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1156 .

Comment 11

[Tim Miao]

(In reply to comment #0)
> User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7)
Gecko/20050408 Firefox/1.0.3
> Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7)
Gecko/20050408 Firefox/1.0.3
> 
> By creating a special sherlock file it is possible to run javascript code in the
> security context of the currently active tab. This allows to create search
> engines that silently monitor all website displayed while searching (e.g. to
> steal sessions cookies) and/or that wait for a privileged page (e.g. chrome or
> about:config) to run arbitrary code.  
> 
> 
> Reproducible: Always
> 
> Steps to Reproduce:
> 1. Open http://bugzilla:[e-mail]/firesearching/
> 2. Follow instructions
> 
> 
> 
> The demo adds a new search engine (called Firesearching) by calling
> sidebar.addSearchEngine() that behaves like a normal Google search. When
> searching with that engine an alert shows that the engine has javascript access
> to the currently active tab. An attacker could silently send the information to
> another host instead. 
> 
> When the currently displayed site is privileged (chrome or about:config) the
> demo requests UniversalXPConnect rights, creates c:\booom.bat and launches the
> batch file (shows a directoy listing in a dos box). This part is Windows only,
> which is a limitation of the demo - the bug affects all platforms.

Hi Michael,

Would you please compose a new test case for mozilla? With this case you
provided here I can't reproduce this bug on mozilla/linux while the os of this
bug is set to all. Please send it to [e-mail].
Thanks.

Comment 12

[Ginn Chen]

Tim, this case does work on Mozilla Suite.