330070 - Investigate mail URLs for abusable actions

Status: NEW

(MailNews Core :: Networking, defect)

Description

[Daniel Veditz [:dveditz]]

Spun off from bug 328454 comment 7. Can mail urls like mailbox, imap, pop embed actions that an attacker could use to do things on the user's behalf. We need to distinguish between URLs that we have added to the message to fetch additional fragments or whatever, and URLs that were in the message when we received it.

Comment 1

[georgi - hopefully not receiving bugspam]

at least imap uris seem to cause problems.

it is possible imap message to load another message in iframe if the
message id, username and imap server are known.

this is unpleasant in an intranet, when most of the above is known.
the recent nested iframe bug allows getting the username and the server
unless i am wrong.

i suspect problems if javascript is enabled in mailnews, investigation
later.

once upon a time, it was possible to abuse imap uris to create folders
(though iirc this abuse was definitely fixed)
can someon give the format for folder creation if still possible?

tested on bird 1.5 and seamonkey latest trunk.

testcase that needs modification to follow.

Comment 2

[georgi - hopefully not receiving bugspam]

Attachment: imapuris local folder

instructions later

Comment 3

[georgi - hopefully not receiving bugspam]

instructions for the imap uris local folder:

1. save the attachment as a local folder.
2. copy the message "imap message - get imap uri"  in it on an imap server
3. open the message titled "imap message - get imap uri" from the server
4. check javascript console for a css error and copy the imap uri - starting with imap://
5. edit the message "fetching imap message" and set the <iframe src="RESULT_OF_STEP4" - you may edit it in the local folder
6. copy the message "fetching imap message" on the imap server and then open it. if the iframe shows the other message, obviously it is loaded.

Comment 4

[georgi - hopefully not receiving bugspam]

on seamonkey mail managed to do the following:

print preview executes javascript, which opens imap://luser@host/msg1 in a browser window. if msg1 contains plain javascript, it gets executed in the browser window and the title of alert() shows "imap://host".

but msg1 can't access the content of other imap:// messages, though it can load them in iframe/window.open().

Comment 5

[Dan Mosedale (:dmosedale, :dmose)]

It's not obvious to me what the likely-case exploit of the thing georgi described is that doesn't require the user to hand-edit a bunch of stuff.  The ones that do spring to my mind aren't very severe at all, particularly since we no longer enable JS for messages at all.  Doing a more general investigation as per comment 0 would be great, but I don't think it can really block 3.1.  Based on that, marking as blocking- for now.

Jesse, if you're aware of some particularly severe way to exploit this, please describe it in detail and renominate.  Thanks!

Comment 6

[David :Bienvenu]

yes, it's impossible to do js in a mail message now, which does seem to make this not particularly exploitable. And we block remote content by default as well.

Comment 7

[Josh Aas]

Opening up based on comments 5 and 6.

Comment 8

[Ludovic Hirlimann [:Usul]]

Removing myslef on all the bugs I'm cced on. Please NI me if you need something on MailNews Core bugs from me.

Comment 9

[Tom Ritter [:tjr]]

If this is TB only, should we clear our sec flags?

Comment 10

[Daniel Veditz [:dveditz]]

Several projects share the keywords (e.g. Mozilla websites) and there are still folks working on Thunderbird. Just don't include mailnews in your queries.