Last Comment Bug 330214 - Content injection spoofing with a combination of headers defined by HTTP/1.0 and 1.1 (e.g. Content-Length and Transfer-Encoding: chunked)
: Content injection spoofing with a combination of headers defined by HTTP/1.0 ...
: fixed1.8.1, testcase, verified1.8.0.4
Product: Core
Classification: Components
Component: Networking: HTTP (show other bugs)
: Trunk
: All All
P1 critical (vote)
: mozilla1.8.1
Assigned To: Darin Fisher
: Patrick McManus [:mcmanus]
Depends on: 429629
  Show dependency treegraph
Reported: 2006-03-11 23:21 PST by Kohei Yoshino [:kohei]
Modified: 2008-05-22 14:11 PDT (History)
8 users (show)
dveditz: blocking1.8.1+
dveditz: blocking1.8.0.4+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

data flow chart (48.14 KB, image/gif)
2006-03-11 23:22 PST, Kohei Yoshino [:kohei]
no flags Details
testcase: python script (819 bytes, text/plain)
2006-04-04 09:37 PDT, Darin Fisher
no flags Details
v1 patch (1.24 KB, patch)
2006-04-04 09:42 PDT, Darin Fisher
cbiesinger: review+
bzbarsky: superreview+
bzbarsky: approval‑branch‑1.8.1+
jaymoz: approval1.8.0.4+
Details | Diff | Splinter Review
1.0.x version (1.89 KB, patch)
2006-06-13 14:45 PDT, Alexander Sack
asac: review? (caillon)
Details | Diff | Splinter Review

Description User image Kohei Yoshino [:kohei] 2006-03-11 23:21:32 PST
User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv: Gecko/20060111 Firefox/
Build Identifier: N/A

Note: This bug was originally reported to IPA (Information-technology Promotion Agency, Japan) and forwarded to us at Mozilla Japan. I'm NOT original reporter. Don't mention my name in the security advisory. For more information about IPA, visit 


Attackers can forge a Web page on another domain by sending the HTTP response including "Content-Length" header and "Transfer-Encoding: chunked" header. This could be used for the real phishing to steal sensitive data, such as user password or cookies. 

Windows XP Professional SP2
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060129 Firefox/1.6a1

Reproducible: Sometimes

Steps to Reproduce:
1. Set up Firefox to use Squid/2.5.STABLE12 for HTTP proxy
2. Configure Squid. Set the value of "persistent_request_timeout" to "1 minute".
2. Provide the proxy with HTTP response with the following conditions:
 A. "Content-Length" header is included
 B. "Transfer-Encoding: chunked" is included
 C. response length with chunk size data of B is shorter than the value of A

Actual Results:  
Squid conforms to HTTP/1.0, not to HTTP/1.1. Therefore, It will send data of the number of bytes specified by Content-Length header to the browser. Transfer-Encoding header with a space will be transferred as is. This is appropriate behavior compliant with HTTP/1.0.

Firefox will receive the response via proxy and handle the response body based on Transfer-Encoding header. Firefox determines the termination of message body based on the last chunk of chunked encoding, not Content-Length.

The rest of response determined by the condition C is incorrectly recognized as the response of following HTTP request.

Expected Results:  
The rest of response should not be recognized as the response of following HTTP request.

Additional Information:
The malicious Web site admins can target Firefox users who use HTTP proxy (that keep-alive anabled) to steal cookies or build web pages including fake login form for arbitrary domains.

Original reporter says that Firefox doesn't ignore the header that isn't part of HTTP/1.0 (but is defined by HTTP/1.1) when it interprets HTTP/1.0 response. Although this report makes an issue of Transfer-Encoding header, but other headers might be a problem.

Reporter also says Firefox should be implemented not to reuse stream that is connected to the HTTP proxy when it starts connection to another web server.

Workaround for Squid admins: disable keep-alive
Comment 1 User image Kohei Yoshino [:kohei] 2006-03-11 23:22:52 PST
Created attachment 214812 [details]
data flow chart

IPA send us the data flow chart. I attach it.
Comment 2 User image Kohei Yoshino [:kohei] 2006-03-19 08:41:07 PST
Any updates?
Comment 3 User image Darin Fisher 2006-03-30 17:12:04 PST
So, I think that if we get a HTTP/1.0 response, we should favor a Content-Length header of a Transfer-Encoding header.  I worry that ignoring Transfer-Encoding headers entirely will result in incompatibilities.  I need to check what IE does.
Comment 4 User image Darin Fisher 2006-04-03 20:55:05 PDT
IE6 seems to correctly ignore the "Transfer-Encoding: chunked" header when included in the response from a HTTP/1.0 server.  So, we can easily do the same.
Comment 5 User image Darin Fisher 2006-04-04 09:37:04 PDT
Created attachment 217164 [details]
testcase: python script

Here's a simple python script that demonstrates the bug.  Load http://host:4444/ twice and if you get a popup that says "hacked" then you're browser is vulnerable.
Comment 6 User image Darin Fisher 2006-04-04 09:42:15 PDT
Created attachment 217165 [details] [diff] [review]
v1 patch

Make us behave like IE6.
Comment 7 User image Christian :Biesinger (don't email me, ping me on IRC) 2006-04-04 15:03:40 PDT
but what does IE6 do when the version is 1.1 and the situation is otherwise the same? put differently, doesn't this just require changing the attack to use a 1.1 version?
Comment 8 User image Darin Fisher 2006-04-04 19:00:03 PDT
> but what does IE6 do when the version is 1.1 and the situation is otherwise the
> same? put differently, doesn't this just require changing the attack to use a
> 1.1 version?

You're asking what if the proxy server spoke 1.1?  Then, the proxy server would not be fooled into forwarding the embedded response, and the exploit wouldn't exist.  My python testcase is not an exact replica of the actual exploit in that it is not a proxy server.  It just demonstrates the same underlying problem.
Comment 9 User image Darin Fisher 2006-04-04 19:09:52 PDT
Comment 10 User image Jay Patel [:jay] 2006-04-07 13:00:41 PDT
Comment on attachment 217165 [details] [diff] [review]
v1 patch

a=jay for drivers, please get this on the 1.8.0 branch.  Thanks!
Comment 11 User image Darin Fisher 2006-04-07 17:37:39 PDT
Comment 12 User image Darin Fisher 2006-04-07 17:43:04 PDT
Comment 13 User image Jay Patel [:jay] 2006-04-20 15:48:40 PDT
v.fixed on 1.8.0 branch: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv: Gecko/20060420 Firefox/, no "hacked" popup with Darin's python script testcase.

Kohei:  If you want to also verify this bug and the other http header fixes with your proxy setup, please do so and let us know if things look ok.  Thanks!
Comment 14 User image Kohei Yoshino [:kohei] 2006-05-09 22:15:28 PDT
IPA have confirmed that this vulnerability affects Firefox only.
It's OK to publish security advisory as of Firefox Thanks!
Comment 15 User image Kohei Yoshino [:kohei] 2006-05-24 22:29:40 PDT
IPA told us that the original reporter is Kazuho Oku (Cybozu Labs).

dveditz: Please mention his name in the upcoming advisory.
Comment 16 User image Alexander Sack 2006-06-13 14:45:49 PDT
Created attachment 225475 [details] [diff] [review]
1.0.x version

a proposed backport.

Note You need to log in before you can comment on or make changes to this bug.