295011 - QueryInterface() allows arbitrary code execution

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[shutdown]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4

XPConnect wrapped native objects' "QueryInterface" method is a native
function which (erroneously) exposes the privileged Function constructor
as its constructor. Such privileged constructor can be accessed by an
expression such as "QueryInterface.constructor", and allows attackers
to construct and execute arbitrary privileged code.


Reproducible: Always

Steps to Reproduce:
1. load the testcase.

Actual Results:  
The privileged Function constructor can be accessed by
QueryInterface.constructor and allows to execute arbitary code.


Expected Results:  
The privileged Function constructor must not be accessable at all.
(QueryInterface.constructor == Function) is true.

Comment 1

[shutdown]

Attachment: testcase

testcase for the problem.

Comment 2

[shutdown]

oneliner testcase
javascript: alert(QueryInterface.constructor("return Components.classes;")());

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Confirmed, trunk Linux build.

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

That said, this may be a duplicate of bug 294795.

Comment 5

[Darin Fisher]

My Firefox 1.0.4 on WinXP, returns false for the "(QueryInterface.constructor ==
Function)" test.  When I load the testcase, I do not see an alert.  Hmm...

The one liner from comment #2 triggers the following exception:
Error: uncaught exception: Permission denied to get property UnnamedClass.classes

Could my Firefox be configured funny?

Comment 6

[georgi - hopefully not receiving bugspam]

confirming on linux - both 1.0.4 and today's cvs trunk.

Comment 7

[Peter Van der Beken [:peterv]]

This doesn't seem limited to QueryInterface.
javascript:alert(open.constructor("return
window.document.location.toString();")()); gives me
chrome://browser/content/hiddenWindow.xul in Firefox 1.0.4 on OS X, so it might
be related to
http://lxr.mozilla.org/seamonkey/source/js/src/xpconnect/src/xpcwrappednativeinfo.cpp#114

Comment 8

[shutdown]

(In reply to comment #7)
> This doesn't seem limited to QueryInterface.
> javascript:alert(open.constructor("return
> window.document.location.toString();")()); gives me
> chrome://browser/content/hiddenWindow.xul in Firefox 1.0.4 on OS X

It gives me "about:blank" in Firefox 1.0.4 on Win98.
hiddenWindow.xul is described as Mac OS X thing in this page.
http://kb.mozillazine.org/About:config_entries

javascript: alert(open.constructor.__parent__);
==> [object ChromeWindow]

Comment 9

[shutdown]

I'm sorry. I changed Severity by mistake. Blame me...

Comment 10

[Johnny Stenback (:jst)]

Marking FIXED now that bug 294795 is fixed.

Comment 11

[Jay Patel [:jay]]

v.fixed on aviary with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.9)
Gecko/20050706 Firefox/1.0.5 using attached testcase, all checks passed.

Comment 12

[Daniel Veditz [:dveditz]]

Adding distributors