362103 - Remote code execution through Conduit toolbars (incl. BBC and Digg toolbars)

Status: RESOLVED FIXED

(addons.mozilla.org Graveyard :: Administration, defect)

Description

[Wladimir Palant]

This is a bug the file ebtoolbar.js used by a few dozen toolbar extensions, e.g. BBC Bar or Australio Radio Toolbar. The toolbars inject a JavaScript object EBToolbarApi into the web pages that has a method ExecuteFunction accepting a string. This method will evaluate the passed string in chrome context.

Testcase coming.

Comment 1

[Wladimir Palant]

Attachment: Testcase

Install one of the toolbar extensions e.g. BBC Bar and open this testcase. You will be presented a list of your cookies, the page could do anything else as well - with the privileges of your browser.

Comment 2

[Wladimir Palant]

I don't have all the extensions on my harddisk but from the ones I have affected are:

* Abandonia Toolbar
* All Yours Chats Toolbar
* Anderson Tech Club Toolbar
* Atom Sounds Toolbar
* Australia-Radio Toolbar
* BBC Bar
* Bob Dawg's Pad Toolbar
* BX Toolbar
* Careforkids Toolbar
* Casino Free Money Toolbar
* Celebar
* Cengoo.de Toolbar
* CG Toolbar
* Cowgirl Image Toolbar
* Cowgird Model Toolbar
* Deutschland Radio
* Digg.com extension toolbar
* DVDEmpire Toolbar
* EZPharmacyFinder Toolbar

Comment 3

[Wladimir Palant]

Since these extensions are no longer hosted at AMO, I looked at conduit.com, clicking on Community I saw that they feature Gotuit Toolbar. Downloaded, it still has exactly the same backdoor in it.

Well, actually I see a whole bunch of Conduit toolbars in the sandbox but none of them seem to have an install box. I downloaded the TexasBar from the URL in the description - and sure enough, this backdoor is there.

Comment 4

[Mike Shaver (:shaver emeritus)]

Not a lot we can do about it here, since doing a blocklist entry for all of the generated toolbars is basically a non-starter, but I can try to find someone at Conduit to whom to report the bug if you haven't already.

Thanks for the report, it's a pretty serious bug!

Comment 5

[Wladimir Palant]

No, I didn't contact them.

Comment 6

[Mike Shaver (:shaver emeritus)]

That's fair -- contacting the listed authors isn't very helpful, likely, given their usually significant inability to fix anything or even know what's going on. I'll see what I can do, and we should disable the conduit ones from the sandbox too.

Comment 7

[Justin Scott [:fligtar]]

Mike: any updates on this?

Comment 8

[Mike Shaver (:shaver emeritus)]

I sent mail to people at Conduit, haven't heard back.  Not much more we can do on this end. :/

Comment 9

[Rey Bango]

I'm emailing my contact at Conduit. They'd like to get back onto AMO so I'm sure they'll look into this immediately.

Comment 10

[Wladimir Palant]

Supposedly they already fixed that issue in July last year but I didn't verify.

Comment 11

[Rey Bango]

Ok. I've pinged them and asked for confirmation. This recently showed up on my bug list so I was following up.

Comment 12

[Rey Bango]

I confirmed that it's fixed. Closing this.

Comment 13

[Wladimir Palant]

I think that this should be made public by now.