329583 - Sidebar View Image xss

Status: RESOLVED FIXED

(Firefox :: General, defect)

Description

[Paul Nickerson]

Right-clicking a javascript: image on a page in the sidebar and pressing View Image will execute the script in the context of the content window.

Comment 1

[Paul Nickerson]

Attachment: testcase

Comment 2

[Jesse Ruderman]

See also bug 281490, "Many menu items in sidebar context menu don't work".

For a more effective exploit:
* Show a cut-off porn image in the sidebar.
* Tile broken javascript: images with low opacity over the image.
* Use some kind of visual distraction to disguise the sidebar splitter.
* Pick an empty, small, or at least logo-free page on the XSS-victim site.  (e.g. robots.txt, a stylesheet, or a small image.)

I think that exploit would work against enough users and against enough sites to warrant [sg:high].

I can't reproduce in a 2006-02-22 trunk build.

Comment 3

[Martijn Wargers (dead)]

Maybe this would be fixed by the patch in bug 329521. I can't check it right now, because context menus in the sidebar are borked in my debug build.

Comment 4

[Mike Connor [:mconnor]]

So, we haven't reimplemented sidebar panels yet (nor is it clear in what form they'll return, assuming that they do).  Knocking off Fx2 radar, please renominate if/when we add that functionality and this is exploitable in the new impl.

Comment 5

[Paul Nickerson]

Attachment: proposed patch

Checks if the document containing the image is the same as that which will be redirected from. If they're different, javascript/data urls are blocked.

Comment 6

[Paul Nickerson]

Comment on attachment 220585 [details] [diff] [review]
proposed patch

    viewImage : function (e) {
        urlSecurityCheck( this.imageURL, this.docURL );
        //If the image's ownerDocument is in a frame, disallow viewing a javascript image
        var w = getTopWin();
	var b = w.document.getElementById("content");
        if(!b.currentURI.equals(makeURI(this.target.ownerDocument.location))){
            try {
              const secMan = Components.classes["@mozilla.org/scriptsecuritymanager;1"]
                             .getService(Components.interfaces.nsIScriptSecurityManager);
              const nsIScriptSecMan = Components.interfaces.nsIScriptSecurityManager;
              secMan.checkLoadURI(w.document.getElementById("content").currentURI, makeURI(this.imageURL),
                                  nsIScriptSecMan.DISALLOW_SCRIPT_OR_DATA);
              openUILink( this.imageURL, e );
            } catch(e) {}
        }
        else{
            openUILink( this.imageURL, e );
        }
    },

Comment 7

[Paul Nickerson]

apparently that's not how you upload patches :)
i included the updated function source in a comment instead

Comment 8

[Daniel Veditz [:dveditz]]

This is indeed fixed by the patch in bug 329521

Comment 9

[Tracy Walker [:tracy]]

verified with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4

Comment 10

[Marcia Knous [:marcia]]

Litmus Triage Team: tomcat will cover the Litmus test case for this bug.