Last Comment Bug 330214 - Content injection spoofing with a combination of headers defined by HTTP/1.0 and 1.1 (e.g. Content-Length and Transfer-Encoding: chunked)
: Content injection spoofing with a combination of headers defined by HTTP/1.0 ...
Status: RESOLVED FIXED
[sg:high]
: fixed1.8.1, testcase, verified1.8.0.4
Product: Core
Classification: Components
Component: Networking: HTTP (show other bugs)
: Trunk
: All All
: P1 critical (vote)
: mozilla1.8.1
Assigned To: Darin Fisher
:
Mentors:
Depends on: 429629
Blocks:
  Show dependency treegraph
 
Reported: 2006-03-11 23:21 PST by Kohei Yoshino [:kohei]
Modified: 2008-05-22 14:11 PDT (History)
8 users (show)
dveditz: blocking1.8.1+
dveditz: blocking1.8.0.4+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
data flow chart (48.14 KB, image/gif)
2006-03-11 23:22 PST, Kohei Yoshino [:kohei]
no flags Details
testcase: python script (819 bytes, text/plain)
2006-04-04 09:37 PDT, Darin Fisher
no flags Details
v1 patch (1.24 KB, patch)
2006-04-04 09:42 PDT, Darin Fisher
cbiesinger: review+
bzbarsky: superreview+
bzbarsky: approval‑branch‑1.8.1+
jaymoz: approval1.8.0.4+
Details | Diff | Splinter Review
1.0.x version (1.89 KB, patch)
2006-06-13 14:45 PDT, Alexander Sack
asac: review? (caillon)
Details | Diff | Splinter Review

Description Kohei Yoshino [:kohei] 2006-03-11 23:21:32 PST
User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1
Build Identifier: N/A

Note: This bug was originally reported to IPA (Information-technology Promotion Agency, Japan) and forwarded to us at Mozilla Japan. I'm NOT original reporter. Don't mention my name in the security advisory. For more information about IPA, visit http://www.ipa.go.jp/about/english/ 

JVN28513736

Attackers can forge a Web page on another domain by sending the HTTP response including "Content-Length" header and "Transfer-Encoding: chunked" header. This could be used for the real phishing to steal sensitive data, such as user password or cookies. 

Windows XP Professional SP2
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20060129 Firefox/1.6a1


Reproducible: Sometimes

Steps to Reproduce:
1. Set up Firefox to use Squid/2.5.STABLE12 for HTTP proxy
2. Configure Squid. Set the value of "persistent_request_timeout" to "1 minute".
2. Provide the proxy with HTTP response with the following conditions:
 A. "Content-Length" header is included
 B. "Transfer-Encoding: chunked" is included
 C. response length with chunk size data of B is shorter than the value of A

Actual Results:  
Squid conforms to HTTP/1.0, not to HTTP/1.1. Therefore, It will send data of the number of bytes specified by Content-Length header to the browser. Transfer-Encoding header with a space will be transferred as is. This is appropriate behavior compliant with HTTP/1.0.

Firefox will receive the response via proxy and handle the response body based on Transfer-Encoding header. Firefox determines the termination of message body based on the last chunk of chunked encoding, not Content-Length.

The rest of response determined by the condition C is incorrectly recognized as the response of following HTTP request.


Expected Results:  
The rest of response should not be recognized as the response of following HTTP request.


Additional Information:
The malicious Web site admins can target Firefox users who use HTTP proxy (that keep-alive anabled) to steal cookies or build web pages including fake login form for arbitrary domains.

Original reporter says that Firefox doesn't ignore the header that isn't part of HTTP/1.0 (but is defined by HTTP/1.1) when it interprets HTTP/1.0 response. Although this report makes an issue of Transfer-Encoding header, but other headers might be a problem.

Reporter also says Firefox should be implemented not to reuse stream that is connected to the HTTP proxy when it starts connection to another web server.

Workaround for Squid admins: disable keep-alive
Comment 1 Kohei Yoshino [:kohei] 2006-03-11 23:22:52 PST
Created attachment 214812 [details]
data flow chart

IPA send us the data flow chart. I attach it.
Comment 2 Kohei Yoshino [:kohei] 2006-03-19 08:41:07 PST
Any updates?
Comment 3 Darin Fisher 2006-03-30 17:12:04 PST
So, I think that if we get a HTTP/1.0 response, we should favor a Content-Length header of a Transfer-Encoding header.  I worry that ignoring Transfer-Encoding headers entirely will result in incompatibilities.  I need to check what IE does.
Comment 4 Darin Fisher 2006-04-03 20:55:05 PDT
IE6 seems to correctly ignore the "Transfer-Encoding: chunked" header when included in the response from a HTTP/1.0 server.  So, we can easily do the same.
Comment 5 Darin Fisher 2006-04-04 09:37:04 PDT
Created attachment 217164 [details]
testcase: python script

Here's a simple python script that demonstrates the bug.  Load http://host:4444/ twice and if you get a popup that says "hacked" then you're browser is vulnerable.
Comment 6 Darin Fisher 2006-04-04 09:42:15 PDT
Created attachment 217165 [details] [diff] [review]
v1 patch

Make us behave like IE6.
Comment 7 Christian :Biesinger (don't email me, ping me on IRC) 2006-04-04 15:03:40 PDT
but what does IE6 do when the version is 1.1 and the situation is otherwise the same? put differently, doesn't this just require changing the attack to use a 1.1 version?
Comment 8 Darin Fisher 2006-04-04 19:00:03 PDT
> but what does IE6 do when the version is 1.1 and the situation is otherwise the
> same? put differently, doesn't this just require changing the attack to use a
> 1.1 version?

You're asking what if the proxy server spoke 1.1?  Then, the proxy server would not be fooled into forwarding the embedded response, and the exploit wouldn't exist.  My python testcase is not an exact replica of the actual exploit in that it is not a proxy server.  It just demonstrates the same underlying problem.
Comment 9 Darin Fisher 2006-04-04 19:09:52 PDT
fixed-on-trunk
Comment 10 Jay Patel [:jay] 2006-04-07 13:00:41 PDT
Comment on attachment 217165 [details] [diff] [review]
v1 patch

a=jay for drivers, please get this on the 1.8.0 branch.  Thanks!
Comment 11 Darin Fisher 2006-04-07 17:37:39 PDT
fixed1.8.1
Comment 12 Darin Fisher 2006-04-07 17:43:04 PDT
fixed1.8.0.3
Comment 13 Jay Patel [:jay] 2006-04-20 15:48:40 PDT
v.fixed on 1.8.0 branch: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.8.0.2) Gecko/20060420 Firefox/1.5.0.2, no "hacked" popup with Darin's python script testcase.

Kohei:  If you want to also verify this bug and the other http header fixes with your proxy setup, please do so and let us know if things look ok.  Thanks!
Comment 14 Kohei Yoshino [:kohei] 2006-05-09 22:15:28 PDT
IPA have confirmed that this vulnerability affects Firefox only.
It's OK to publish security advisory as of Firefox 1.5.0.4. Thanks!
Comment 15 Kohei Yoshino [:kohei] 2006-05-24 22:29:40 PDT
IPA told us that the original reporter is Kazuho Oku (Cybozu Labs).
FYI: http://labs.cybozu.co.jp/en/archives/2005-08-16-1.html

dveditz: Please mention his name in the upcoming advisory.
Comment 16 Alexander Sack 2006-06-13 14:45:49 PDT
Created attachment 225475 [details] [diff] [review]
1.0.x version

a proposed backport.

Note You need to log in before you can comment on or make changes to this bug.