294278 - Mozilla Suite / Firefox / Thunderbird Nested Anchor Tag Status Bar Spoofing Weakness

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[lukewalcher]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3

From http://www.securityfocus.com/bid/12798 :

Mozilla Suite/Firefox and Thunderbird are reported prone to a URI obfuscation
weakness. The issue is reported to manifest when 'Save Link As...' functionality
is invoked on an malicious anchor tag.

This issue may be leveraged by an attacker to display false information in the
status bar of an unsuspecting user, allowing an attacker to present downloads to
users that seem to originate from a trusted location. This may facilitate
attacks based on this false sense of trust. 

Reproducible: Always

Steps to Reproduce:
1. Create a page with an anchor tag inside a table inside another anchor tag,
where the inner and outer anchor tags don't match.
2. Load the page and Right-click on the link that appears.
3. Click on Save Link As...

Actual Results:  
The "malicious" file is downloaded instead of the expected one.

Expected Results:  
Disallowed the use of the outer anchor tag altogether as it is bad HTML and
showed the link that would actually be used in the status bar.

Comment 1

[Daniel Veditz [:dveditz]]

From a public source, not much point in the confidential flag.

Comment 2

[Daniel Veditz [:dveditz]]

Nested links are technically invalid
(http://www.w3.org/TR/html401/struct/links.html#h-12.2.2), but I guess we
support this kind of thing because it's been used historically.

With two directly nested links they second <a> implicitly closes the first link:
data:text/html,<a%20href=http://www.google.com>click%20<a%20href="http://www.yahoo.com">clack</a>%20cluck</a>

nested in table version:
data:text/html,<a%20href=http://www.google.com>click<table><tr><td><a%20href="http://www.yahoo.com">clack</a></td></tr></table>cluck</a>

The table version is fixed on the trunk ("Deer Park").