411072 - "focus" Event can be used to set focus on file input and selectively capture keystrokes, which can be used to upload arbitrary files

Status: VERIFIED FIXED

(Core :: Security, defect)

Description

[Gregory Fleischer]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11

By creating a "focus" Event and using dispatchEvent to send it to a file
input element or a label associated with the file, the focus can be set on the
text portion of the file input.  This can be used to selectively capture
keystrokes and construct a path that can be used to upload arbitrary files from
a user's computer.

By sending the click as an event, the focus restrictions in bug #370092 and bug #370092 can be bypassed.

An alternate approach is to use the observation in bug #404391 and send click
to an additional input element nested inside of the label.


Reproducible: Always




Tested with user agents:

 - Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11
- Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11
 - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11
- Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8.1.12pre) Gecko/20080106 BonEcho/2.0.0.12pre
- Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.12pre) Gecko/20080106 BonEcho/2.0.0.12pre

Comment 1

[Gregory Fleischer]

Attachment: Example of dispatching focus event to file input element

Comment 2

[Gregory Fleischer]

Attachment: Example of dispatching focus event to label element

Comment 3

[Gregory Fleischer]

Attachment: Example of how an actual attack could be constructed

The focus-event-stealing.html file demonstrates how an actual attack could be constructed.  On Mac OS X and Linux, "/etc/hosts" is targeted and on Windows, "c:\boot.ini".  

The demo is standalone by default, but the included 'upload.cgi' Perl CGI script can be used to capture the submitted the file.

Comment 4

[Gregory Fleischer]

The description should have been:

By sending the focus as an event, the focus restrictions in bug #370092 and bug
#388784 can be bypassed.

Comment 5

[Daniel Veditz [:dveditz]]

Not sure these aren't all ultimately dupes for the same fix, but until that's shown I can confirm we need to fix whatever leads to these testcases.

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

I guess I should fix this. I'll try to come up with a patch during this
weekend.

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

Attachment: And more type="file" fixing...

Comment 8

[Olli Pettay [:smaug][[e-mail]]]

Regardless of bug 413135, fixing this bug would be good.

Comment 9

[Gregory Fleischer]

Attachment: Example attack using disabled property to selectively cancel keystrokes

Updated the example attack to use the disabled property to selectively cancel keystrokes.

This bypasses the fix for bug 413135 in attachment 298006 [details] [diff] [review].

Comment 10

[Samuel Sidler (old account; do not CC)]

Comment on attachment 296728 [details] [diff] [review]
And more type="file" fixing...

Requesting approval on this blocker.

Olli, what's the risk of this patch?

Comment 11

[Olli Pettay [:smaug][[e-mail]]]

The risk should be small. The patch changes only the case when someone is manually
dispatching focus events to <input type="file"> element. The result is that
browser... button is focused, not the text field.

Comment 12

[Daniel Veditz [:dveditz]]

Comment on attachment 296728 [details] [diff] [review]
And more type="file" fixing...

approved for 1.8.1.12, a=dveditz for release-drivers

Comment 13

[Al Billings [:abillings - ex-MoCo]]

Verified with Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.12) Gecko/2008012822 Firefox/2.0.0.12. 

Comment 14

[Alexander Sack]

Comment on attachment 296728 [details] [diff] [review]
And more type="file" fixing...

a=asac for 1.8.0.15

Comment 15

[Christopher Aillon (sabbatical, not receiving bugmail)]

Committed to the 1.8.0 branch...