291314 - content calling java methods causes trouble

Status: RESOLVED FIXED

(Firefox :: Security, defect)

Description

[georgi - hopefully not receiving bugspam]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3

chrome calling java.io.File("/tmp/a").createNewFile() creates a file in /tmp

Reproducible: Always

Steps to Reproduce:
go to url
Actual Results:  
a file with controllable name is created

Comment 1

[georgi - hopefully not receiving bugspam]

Java(TM) Plug-in 1.5.0_02-b09

File name: libjavaplugin_oji.so
Java(TM) Plug-in 1.5.0_02

Comment 2

[Daniel Veditz [:dveditz]]

Chrome can already create a file and more with or without Java, letting it call
into Java with permissions isn't a problem.

The problem here is the chrome event handler calling a content function with
chrome privs. Doesn't matter what the function does, that is the problem.

I couldn't get this to work, but it might be me.

Comment 3

[georgi - hopefully not receiving bugspam]

the exploit works for me with both 1.0.3 and today's cvs trunk (with both
brendan's Script kludge and without)

Comment 4

[Benjamin Smedberg]

Why is this an exploit? Chrome should be allowed to do this.

Comment 5

[georgi - hopefully not receiving bugspam]

did you check "steps to reproduce" and url below "qa contact"?

Comment 6

[Benjamin Smedberg]

I can confirm the testcase...

Comment 7

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

There's at least one bug here, if not two.  I'd comment in more detail, but I'd
rather do that in security-sensitive bugs.  Why was the security flag removed?

Comment 8

[georgi - hopefully not receiving bugspam]

the security flag was removed because i spent time writing a testcase, there was
no action on the bug for 5 days, and someone added himself to cc and asked "Why
is this an exploit?"

Comment 9

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Part of this should be fixed by bug 289940

Comment 10

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Even with the patch in bug 281988 comment 73 i'm worried that someone can do:

theFile = java.io.File('/etc/passwd'');
someNode.nodeName = theFile;
theFile.toUpper = theFile.delete;
event.target = someNode;
document.body.dispatchEvent(event);

then trick us into getting the uppercase nodename of someNode. Will the above
cause |this| to be changed for |delete| triggering the REBOUND flag to get set?

Comment 11

[Brendan Eich [:brendan]]

Sicking, thanks -- jst brought that up too.  See bug 281988 attachment 182729 [details] [diff] [review].

/be

Comment 12

[georgi - hopefully not receiving bugspam]

looks like java objects created by applets aren't exploitable.

can't at least this exploit be solved/kludged by disabling the java.*
constructors  from javascript - seems exploder does not support them?

Comment 13

[Asa Dotzler [:asa]]

this should be fixed on the trunk by bug 281988. Unblocking 1.8b3.

Comment 14

[Jay Patel [:jay]]

Georgi:  This should be fixed on the Trunk, can you retest and report any issues
you still see there?

We need more testing on the Trunk before we can take the other fix from  bug
281988 on the branch.

Comment 15

[georgi - hopefully not receiving bugspam]

testcase doesn't work on today cvs trunk.

but i am not sure if in this testcase java tries to get executed at all, or
fixing some other bug has stopped the codepath.

will try to check this.

Comment 16

[georgi - hopefully not receiving bugspam]

looks like chrome doesn't execute the luser's getter, so it is not clear if the
bug is fixed if chrome would have executed the luser's getter.

Comment 17

[Daniel Veditz [:dveditz]]

Two fixes block this testcase: chrome ignores content-generated events, and on
the trunk chrome doesn't see user-created properties anymore.

Might be able to play around with something like bug 290324 on the 1.0 branch to
get chrome to access java -- we didn't change anything in the way
liveconnect/java works.

Comment 18

[georgi - hopefully not receiving bugspam]

*** Bug 303856 has been marked as a duplicate of this bug. ***

Comment 19

[Tim Riley [:timr]]

The problem is not reproducible.  It may just be blocked by other fixed or there may be another unknown path to cause it.  Either way we can't fix what we can't see.  No patch.  So can't make it into 1.0.8.

Comment 20

[georgi - hopefully not receiving bugspam]

(In reply to comment #19)
> The problem is not reproducible.  It may just be blocked by other fixed or
> there may be another unknown path to cause it.  Either way we can't fix what we
> can't see.  No patch.  So can't make it into 1.0.8.
> 

some other fix killed the bug of calling it.

more actual similar "issue" is bug 324630