290079 - arbitrary code execution via sidebar (part 2)

Status: VERIFIED FIXED

(Firefox :: Security, defect)

Description

[u115577]

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8b2) Gecko/20050412
Firefox/1.0+

Sidebar allows an attacker to link to the privileged content (such as
about:config) and run arbitrary code on the content.

If anchor contains target="_search", all security checks are bypassed.
http://lxr.mozilla.org/mozilla/source/browser/base/content/browser.js#4687

Related: Bug 284627

Reproducible: Always

Steps to Reproduce:
1. Click links in order

Actual Results:  
about:plugins is loaded into Sidebar web panel. "browser.startup.homepage" will
be overwritten. Further attacks can be done successfully.

Expected Results:  
Link to the privileged content should be blocked.

Comment 1

[u115577]

Attachment: testcase

Comment 2

[sairuh (rarely reading bugmail)]

I can confirm that the attached test case changes my homepage to mozdev.org.

Comment 3

[u115577]

In Mozilla Suite, the testcase failed to load about:plugins. Expected security
error appears in JavaScript Console. This is a Firefox-specific bug.

Comment 4

[Mike Connor [:mconnor]]

Attachment: add security check, block javascript: URLs completely (matching IE)

This is a double-layered fix:

Add the obvious missing security check.
Block javascript: URLs entirely if they target _search.  This is matching
behaviour to IE, and since this is an IE-ism, I feel completely safe in taking
this step.

I will file a followup bug tonight or tomorrow about looking over our web
panels code and better bulletproofing this against future silliness.

Comment 5

[Chase Phillips]

Comment on attachment 180532 [details] [diff] [review]
add security check, block javascript: URLs completely (matching IE)

Who should review/superreview this patch?

a=chase pending r/sr

Comment 6

[Daniel Veditz [:dveditz]]

Comment on attachment 180532 [details] [diff] [review]
add security check, block javascript: URLs completely (matching IE)

looks good, but needs data: too.

Comment 7

[Daniel Veditz [:dveditz]]

Attachment: similar testcase with data:

Comment 8

[Daniel Veditz [:dveditz]]

Note that the webSecurityCheck() prevents the opening of chrome, but even
without chrome privs you could load some target site in the sidebar and then
inject script using data: to steal cookies or whatever else might be there.

The testcase is polite about waiting for us to click two links in succession, a
real exploit would simply attack.

Comment 9

[Christopher Aillon (sabbatical, not receiving bugmail)]

Attachment: Patch also checking data:

mconnor is having issues with cvs and bugzilla access right now, but asked me
to attach this.

r=caillon
a=caillon for aviary 1.0.3 and 1.1a pending sr=

Comment 10

[Daniel Veditz [:dveditz]]

Comment on attachment 180547 [details] [diff] [review]
Patch also checking data:

sr=dveditz
too bad these aren't uris

Comment 11

[Christopher Aillon (sabbatical, not receiving bugmail)]

Commited attachment 180547 [details] [diff] [review] to AVIARY_1_0_1_20050124_BRANCH, 2005-04-12 21:43 PDT.

Comment 12

[u115577]

I'm testing 2005-04-13-00-aviary1.0.1.

"Click Here First" - JavaScript console says "Security Error: Content at
https://bugzilla.mozilla.org/attachment.cgi?id=180506 may not load or link to
about:plugins."

"Next, Click Here" - nothing happens.

data: testcase produced the same results. Looks good.

Comment 13

[sairuh (rarely reading bugmail)]

also looks good (get expected errors) using 2005041301-1.0.3 ffox on linux fc3.

Comment 14

[Daniel Veditz [:dveditz]]

Fix released

Comment 15

[u115577]

Don't forget to commit patch on the trunk ;-)

Comment 16

[Mike Connor [:mconnor]]

fixed on trunk as of yesterday.

Comment 17

[Greg K.]

Verified fixed using Win FF 1.5.