363597 - XSS by using javascript: url

Status: VERIFIED FIXED

(Core :: Security, defect)

Description

[moz_bug_r_a4]

When javascript: url is evaluated in the sandbox, and its resulting value is an
object, the object's toString and valueOf methods defined by sandboxed script
can be called on the web page's context.

This is exploitable by using Array.prototype methods trick (bug 344495).

The trunk, fx2.0.0.1 and fx1.5.0.9 are affected.

Comment 1

[moz_bug_r_a4]

Attachment: testcase 1 - img.src = javascript:...

This tries to get cookies for www.mozilla.com.

Comment 2

[moz_bug_r_a4]

Attachment: testcase 2 - frames[0].location = javascript:...

This tries to get cookies for www.mozilla.com.

Comment 3

[Daniel Veditz [:dveditz]]

We've got to do something about the trick in bug 344495

Comment 4

[Daniel Veditz [:dveditz]]

Moving out per Blake

Comment 5

[moz_bug_r_a4]

"testcase 1" no longer works on trunk, since javascript: url is not executed in
img.src on trunk. (see bug 369244.)

"testcase 2" no longer works on trunk.  It uses strObj.eval.valueOf to access
Object.prototype.valueOf, but now strObj.eval is undefined on trunk. (see bug
382509.)  I'll attach a new testcase, which uses strObj.valueOf.valueOf to
access Object.prototype.valueOf.

Comment 6

[moz_bug_r_a4]

Attachment: testcase 3 - frames[0].location = javascript:...

- var v = this.eval.valueOf;
+ var v = this.valueOf.valueOf;

Comment 7

[moz_bug_r_a4]

Attachment: testcase 4 (testcase 1) - img.src = javascript:...

bug 377092 comment 3
> Note: when we fix this, retest bug 363597 testcase 1 to make sure all is OK.
> 

This should be needed when retesting.

- var v = this.eval.valueOf;
+ var v = this.valueOf.valueOf;

Comment 8

[Damon Sicore (:damons)]

Targeting to A6 per conversation with Blake.

Comment 9

[Mike Connor [:mconnor]]

punting remaining a6 bugs to b1, all of these shipped in a5, so we're at least no worse off by doing so.

Comment 10

[Blake Kaplan (:mrbkap) (inactive)]

This should now be fixed by the checkin for bug 386635.

Comment 11

[Boris Zbarsky [:bzbarsky]]

Should get this into a test suite.

Comment 12

[Daniel Veditz [:dveditz]]

The fix was backed out.

Comment 13

[Blake Kaplan (:mrbkap) (inactive)]

A new, improved fix was checked in in bug 372075.

Comment 14

[Blake Kaplan (:mrbkap) (inactive)]

And now fixed on the 1.8 branch thanks to that bug.

Comment 15

[moz_bug_r_a4]

Just for the record, all testcases in this bug (testcase 1-4) use bug 344495's
trick.

Comment 16

[Al Billings [:abillings - ex-MoCo]]

Verified with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.12) Gecko/2008020121 Firefox/2.0.0.12 for branch.

Comment 17

[Al Billings [:abillings - ex-MoCo]]

Verified for trunk with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9b4pre) Gecko/2008020504 Minefield/3.0b4pre and Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b4pre) Gecko/2008020504 Minefield/3.0b4pre.