411073 - File upload input focus stealing: if click event is canceled on label with tabindex, focus is set on file text entry field

Status: VERIFIED FIXED

(Core :: Security, defect)

Description

[Gregory Fleischer]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11

If a label element associated with a file input element has a "tabindex" attribute, click events can be canceled and focus is set on the file text entry field.

Once the focus is set on the file element, any entered keystrokes can be selectively captured and potentially used to upload arbitrary files from the user.


Reproducible: Always




Tested with user agents:

 - Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1.11)
Gecko/20071127 Firefox/2.0.0.11
- Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8.1.11) Gecko/20071127
Firefox/2.0.0.11
 - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11) Gecko/20071127
Firefox/2.0.0.11
- Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8.1.12pre)
Gecko/20080106 BonEcho/2.0.0.12pre
- Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.12pre)
Gecko/20080106 BonEcho/2.0.0.12pre

Comment 1

[Gregory Fleischer]

Attachment: Example of canceling click event on label

Comment 2

[Gregory Fleischer]

Attachment: Demo of how attack could be constructed

The file-label-click-cancel-stealing.html file demonstrates how an actual attack could be constructed.  On Mac OS X and Linux, "/etc/hosts" is targeted and on Windows, "c:\boot.ini".  The JavaScript and image files are required for the demo to function properly.

The demo is standalone by default, but the included 'upload.cgi' Perl CGI
script can be used to capture the submitted the file.

Comment 3

[Daniel Veditz [:dveditz]]

The fix in bug 413135 makes this attack ineffective on branch; trunk not affected.

Comment 4

[Gregory Fleischer]

Attachment: Example attack using disabled property to selectively cancel keystrokes

Updated the example attack to use the disabled property to selectively cancel keystrokes.

This bypasses the fix for bug 413135 in attachment 298006 [details] [diff] [review].

Comment 5

[Al Billings [:abillings - ex-MoCo]]

Yes, this is not fixed in branch. I ran all three demos test cases in Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.12) Gecko/2008012822 Firefox/2.0.0.12 and was able to reproduce the bug without difficulty.

Comment 6

[Al Billings [:abillings - ex-MoCo]]

My bad. The test cause is counterintuitive. 

Olli and I just conferred and this is fixed. Re-resolving and verifying.