330037 - Embed Propertypage Remote Compromise (version 2)

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[Paul Nickerson]

The patch from the previous advisory can be circumvented if the following two changes are made:
1) The embed element is shown on a javascript page
2) The executed javascript accesses chrome using it's full priviledges to the opener object

This can be exploited using a small amount of user interaction which will likely occur given the right social engineering.

Comment 1

[Paul Nickerson]

Attachment: testcase

Navigates to a javascript:"content" page. Click on the broken embed box and press manual install. An alert will be shown in the chrome window indicating the execution of arbitrary script.

Comment 2

[Martijn Wargers (dead)]

Attachment: patch

Well, this fixes it for me, by moving some code in nsScriptSecurityManager.cpp.

Comment 3

[Doron Rosenberg (IBM)]

The code in the plugin finder is:
http://lxr.mozilla.org/seamonkey/source/toolkit/mozapps/plugins/content/pluginInstallerWizard.js#566

This is probably a stupid question, but would the evalInSandbox stuff (http://developer.mozilla.org/en/docs/evalInSandbox) be any better for this code?

Comment 4

[Daniel Veditz [:dveditz]]

Another example of the evils of string URL compares rather than principal compares.

Comment 5

[Daniel Veditz [:dveditz]]

Comment on attachment 214683 [details] [diff] [review]
patch

This is good as a band-aide. r/sr=dveditz

Comment 6

[Doron Rosenberg (IBM)]

I filed bug 330102 on myself to switch the code to nsIPrincipal 

Comment 7

[Martijn Wargers (dead)]

Sorry, but do I need sr+ for the patch?

Comment 8

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 214683 [details] [diff] [review]
patch

Generally, yes.  ;)

Comment 9

[Martijn Wargers (dead)]

Checking in caps/src/nsScriptSecurityManager.cpp;
/cvsroot/mozilla/caps/src/nsScriptSecurityManager.cpp,v  <--  nsScriptSecurityMa
nager.cpp
new revision: 1.289; previous revision: 1.288
done

Checked into trunk.

Comment 10

[:Gavin Sharp [email: [e-mail]]]

Checked in on the 1.8 branch.
mozilla/caps/src/nsScriptSecurityManager.cpp; new revision: 1.266.2.10;

Comment 11

[Daniel Veditz [:dveditz]]

Comment on attachment 214683 [details] [diff] [review]
patch

approved for 1.8.0 branch, a=dveditz for drivers

Comment 12

[:Gavin Sharp [email: [e-mail]]]

mozilla/caps/src/nsScriptSecurityManager.cpp 	1.266.2.7.2.5

Comment 13

[Jay Patel [:jay]]

v.fixed on 1.8.0 branch: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4 with testcase.

Comment 14

[Daniel Veditz [:dveditz]]

Impact lowered to "moderate" given the user interaction required. A legit "manual" install button is used to download and install and that could be malware as well, the only difference is this exploit removes one last chance for the user to think better of running the downloaded install.

Comment 15

[Alexander Sack]

Attachment: 1.0.x version