407289 - XPCNativeWrapper calls untrusted functions during construction

Status: VERIFIED FIXED

(Core :: XPConnect, defect, P2)

Description

[moz_bug_r_a4]

The fix for bug 399298 can be circumvented, since a getter for .prototype can
be called in js_GetClassPrototype.

Comment 1

[moz_bug_r_a4]

Attachment: testcase - arbitrary code execution

This uses bug 344495's trick.
This works on trunk, fx2.0.0.x, fx1.5.0.x, sm-trunk, sm1.1.x and sm1.0.x.

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

This is slightly different than bug 399298. In that bug XPCNativeWrappers had an evil prototype. In this bug, we're actually calling untrusted functions (in this case via a getter) from a trusted context. I think I know how to fix this, but it's going to be a few days before I'll get a chance to code it up.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

So, the problem is that we're still looking for XPCNativeWrapper in our parent's scope and getting properties off of the return value. Since those properties can have getters, this runs arbitrary code and we're vulnerable to bug 344495 style attacks.

This patch makes us use the context's global object or currently running stack frame to find the XPCNativeWrapper prototype. I *think* this should be safe because we try to only run trusted code on trusted contexts. We fix up the parent to be what it should be after the fact, so this shouldn't break any trust contracts.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Right patch

Sorry, that last patch was missing a ::JS_SetParent.

Comment 5

[Brendan Eich [:brendan]]

Comment on attachment 293171 [details] [diff] [review]
Right patch

JS_NewObject API considered harmful, eh? If you can phrase it crisply and propose a better API, please do file a bug on that. Thanks,

/be

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into trunk. I filed bug 408871 on the JS_NewObject pain.

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

Fixed on the 1.8 branch as part of the patch in bug 399298.

Comment 8

[Al Billings [:abillings - ex-MoCo]]

Verified in Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.12) Gecko/2008012822 Firefox/2.0.0.12 with attached testcase. No issues and the case reproduces cleanly in 2.0.0.11. 

I also verified it in trunk with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9b3pre) Gecko/2008012804 Minefield/3.0b3pre.