330214 - Content injection spoofing with a combination of headers defined by HTTP/1.0 and 1.1 (e.g. Content-Length and Transfer-Encoding: chunked)

Status: RESOLVED FIXED

(Core :: Networking: HTTP, defect, P1)

Description

[Kohei Yoshino [:kohei]]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1
Build Identifier: N/A

Note: This bug was originally reported to IPA (Information-technology Promotion Agency, Japan) and forwarded to us at Mozilla Japan. I'm NOT original reporter. Don't mention my name in the security advisory. For more information about IPA, visit http://www.ipa.go.jp/about/english/ 

JVN28513736

Attackers can forge a Web page on another domain by sending the HTTP response including "Content-Length" header and "Transfer-Encoding: chunked" header. This could be used for the real phishing to steal sensitive data, such as user password or cookies. 

Windows XP Professional SP2
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060129 Firefox/1.6a1


Reproducible: Sometimes

Steps to Reproduce:
1. Set up Firefox to use Squid/2.5.STABLE12 for HTTP proxy
2. Configure Squid. Set the value of "persistent_request_timeout" to "1 minute".
2. Provide the proxy with HTTP response with the following conditions:
 A. "Content-Length" header is included
 B. "Transfer-Encoding: chunked" is included
 C. response length with chunk size data of B is shorter than the value of A

Actual Results:  
Squid conforms to HTTP/1.0, not to HTTP/1.1. Therefore, It will send data of the number of bytes specified by Content-Length header to the browser. Transfer-Encoding header with a space will be transferred as is. This is appropriate behavior compliant with HTTP/1.0.

Firefox will receive the response via proxy and handle the response body based on Transfer-Encoding header. Firefox determines the termination of message body based on the last chunk of chunked encoding, not Content-Length.

The rest of response determined by the condition C is incorrectly recognized as the response of following HTTP request.


Expected Results:  
The rest of response should not be recognized as the response of following HTTP request.


Additional Information:
The malicious Web site admins can target Firefox users who use HTTP proxy (that keep-alive anabled) to steal cookies or build web pages including fake login form for arbitrary domains.

Original reporter says that Firefox doesn't ignore the header that isn't part of HTTP/1.0 (but is defined by HTTP/1.1) when it interprets HTTP/1.0 response. Although this report makes an issue of Transfer-Encoding header, but other headers might be a problem.

Reporter also says Firefox should be implemented not to reuse stream that is connected to the HTTP proxy when it starts connection to another web server.

Workaround for Squid admins: disable keep-alive

Comment 1

[Kohei Yoshino [:kohei]]

Attachment: data flow chart

IPA send us the data flow chart. I attach it.

Comment 2

[Kohei Yoshino [:kohei]]

Any updates?

Comment 3

[Darin Fisher]

So, I think that if we get a HTTP/1.0 response, we should favor a Content-Length header of a Transfer-Encoding header.  I worry that ignoring Transfer-Encoding headers entirely will result in incompatibilities.  I need to check what IE does.

Comment 4

[Darin Fisher]

IE6 seems to correctly ignore the "Transfer-Encoding: chunked" header when included in the response from a HTTP/1.0 server.  So, we can easily do the same.

Comment 5

[Darin Fisher]

Attachment: testcase: python script

Here's a simple python script that demonstrates the bug.  Load http://host:4444/ twice and if you get a popup that says "hacked" then you're browser is vulnerable.

Comment 6

[Darin Fisher]

Attachment: v1 patch

Make us behave like IE6.

Comment 7

[Christian :Biesinger (don't email me, ping me on IRC)]

but what does IE6 do when the version is 1.1 and the situation is otherwise the same? put differently, doesn't this just require changing the attack to use a 1.1 version?

Comment 8

[Darin Fisher]

> but what does IE6 do when the version is 1.1 and the situation is otherwise the
> same? put differently, doesn't this just require changing the attack to use a
> 1.1 version?

You're asking what if the proxy server spoke 1.1?  Then, the proxy server would not be fooled into forwarding the embedded response, and the exploit wouldn't exist.  My python testcase is not an exact replica of the actual exploit in that it is not a proxy server.  It just demonstrates the same underlying problem.

Comment 9

[Darin Fisher]

fixed-on-trunk

Comment 10

[Jay Patel [:jay]]

Comment on attachment 217165 [details] [diff] [review]
v1 patch

a=jay for drivers, please get this on the 1.8.0 branch.  Thanks!

Comment 11

[Darin Fisher]

fixed1.8.1

Comment 12

[Darin Fisher]

fixed1.8.0.3

Comment 13

[Jay Patel [:jay]]

v.fixed on 1.8.0 branch: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.8.0.2) Gecko/20060420 Firefox/1.5.0.2, no "hacked" popup with Darin's python script testcase.

Kohei:  If you want to also verify this bug and the other http header fixes with your proxy setup, please do so and let us know if things look ok.  Thanks!

Comment 14

[Kohei Yoshino [:kohei]]

IPA have confirmed that this vulnerability affects Firefox only.
It's OK to publish security advisory as of Firefox 1.5.0.4. Thanks!

Comment 15

[Kohei Yoshino [:kohei]]

IPA told us that the original reporter is Kazuho Oku (Cybozu Labs).
FYI: http://labs.cybozu.co.jp/en/archives/2005-08-16-1.html

dveditz: Please mention his name in the upcoming advisory.

Comment 16

[Alexander Sack]

Attachment: 1.0.x version

a proposed backport.