Bug 424733 (CVE-2008-5023)

[FIX]CSS -moz-binding property bypasses security checks on codebase principals

RESOLVED FIXED

Status

()

Core
Security: CAPS
P1
normal
RESOLVED FIXED
9 years ago
9 years ago

People

(Reporter: Collin Jackson, Assigned: bz)

Tracking

({verified1.8.1.18, verified1.9.0.4})

unspecified
verified1.8.1.18, verified1.9.0.4
Points:
---
Dependency tree / graph
Bug Flags:

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [sg:high], URL)

Attachments

(2 attachments)

(Reporter)

Description

9 years ago
Following up on comment 9 on bug 424426 <https://bugzilla.mozilla.org/show_bug.cgi?id=424426#c9>, we did some testing and it appears that stylesheets don't invoke downgrading/blocking rules for codebase principals.

If a signed JAR includes <link rel="stylesheet" href="some_relative_path.css"> anywhere inside it, a malicious web site can replace the stylesheet using the JAR-switching technique originally described in comment #1 on bug 424426 <https://bugzilla.mozilla.org/show_bug.cgi?id=418996#c1>. The malicious stylesheet can then use the -moz-binding property to inject script into the page and hijack the signer's privileges.

The proof of concept is the "CSS" test case at <http://crypto.stanford.edu/~collinj/research/signed-scripts/more-relative-paths.html>.

It is likely that Flash and Java have similar problems.
ccing some more folks who might have bright ideas.  I really need to focus on thesis..

As an aside, "bug X comment Y" will get properly linkified to point to that comment by Bugzila.
Flags: blocking1.9?

Comment 2

9 years ago
DVeditz can you take this one?
Flags: blocking1.9? → blocking1.9+
Priority: -- → P2

Comment 3

9 years ago
DVeditz (over email) indicated that we could take this on a dot release since the attack surface is somewhat limited and we are out of time.  If I've misrepresented or anyone otherwise disagrees please do re-nom.   
Flags: wanted1.9.0.x?
Flags: blocking1.9-
Flags: blocking1.9+
So what are we actually planning on doing here? Simply downgrade the principal when a signed jar sinlks to an unsigned stylesheet? The downgrade resulting in removed urlbar indicator and removed lock icon. And removed ability to request elevated privileges?

Comment 5

9 years ago
Downgrading the principal doesn't really work; see Bug 424426.  We should probably do the same thing we do for scripts: block loading the resource if it has a different codebase principal.
Assignee: dveditz → nobody
Flags: wanted1.8.1.x+
Flags: blocking1.9.1?
Flags: blocking1.8.1.16?
Whiteboard: [sg:high]
Assignee: nobody → dveditz
Flags: wanted1.9.0.x?
Flags: wanted1.9.0.x+
Flags: blocking1.9.1?
Flags: blocking1.9.1+
Priority: P2 → P1
Flags: blocking1.8.1.17? → blocking1.8.1.17+
Boris, can you take a look at this?
Assignee: dveditz → bzbarsky
Flags: blocking1.9.0.2?
This should block 1.9.0.2 but it doesn't look like any progress has been made so it'll probably get pushed...
Flags: blocking1.9.0.2? → blocking1.9.0.2+
Whiteboard: [sg:high] → [sg:high][needs patch]
Pushing this out since it's unlikely to make it, per bz.
Flags: blocking1.9.0.3+
Flags: blocking1.9.0.2-
Flags: blocking1.9.0.2+
Flags: blocking1.8.1.18+
Flags: blocking1.8.1.17-
Flags: blocking1.8.1.17+
Created attachment 335410 [details] [diff] [review]
Turned out to be easier than I thought
Attachment #335410 - Flags: superreview?(jonas)
Attachment #335410 - Flags: review?(jonas)
Summary: CSS -moz-binding property bypasses security checks on codebase principals → [FIX]CSS -moz-binding property bypasses security checks on codebase principals
Whiteboard: [sg:high][needs patch] → [sg:high]
Wouldn't it be better to block loading of XBL entirely instead if the page is signed? The AllowScripts thing is mostly there as a leftover from when we tried to stop scripts in skins and ideally should be removed.
You mean if the page is signed and the XBL is not?  I think we want to allow loading XBL from the same jar.... the problem is that we don't know at load start time whether it's signed, no?

We use AllowScripts to enforce the "JS enabled" preference for untrusted XBL, so I doubt it's going away any time soon...
On second thought, not blocking on this.
Flags: blocking1.9.1+ → blocking1.9.1-
Jonas: were you waiting for a new patch or is Boris's answer OK?
Whiteboard: [sg:high] → [sg:high] needs r=jonas
Comment on attachment 335410 [details] [diff] [review]
Turned out to be easier than I thought

Ok, given that it's this simple.
Attachment #335410 - Flags: superreview?(jonas)
Attachment #335410 - Flags: superreview+
Attachment #335410 - Flags: review?(jonas)
Attachment #335410 - Flags: review+
Pushed changeset 7fb158704fe9.
Status: NEW → RESOLVED
Last Resolved: 9 years ago
Resolution: --- → FIXED
Comment on attachment 335410 [details] [diff] [review]
Turned out to be easier than I thought

This applies as-is to the 1.9 branch.
Attachment #335410 - Flags: approval1.9.0.4?
Created attachment 343670 [details] [diff] [review]
1.8 branch version
Attachment #343670 - Flags: approval1.8.1.18?
Comment on attachment 335410 [details] [diff] [review]
Turned out to be easier than I thought

Approved for 1.9.0.4, a=dveditz for release-drivers
Attachment #335410 - Flags: approval1.9.0.4? → approval1.9.0.4+
Comment on attachment 343670 [details] [diff] [review]
1.8 branch version

Approved for 1.8.1.18, a=dveditz for release-drivers
Attachment #343670 - Flags: approval1.8.1.18? → approval1.8.1.18+
Fixed on both branches.
Keywords: fixed1.8.1.18, fixed1.9.0.4
Whiteboard: [sg:high] needs r=jonas → [sg:high]
Is there a good way to verify this fix?
Following the directions in comment 0 and the site linked from it?
Doh.

Verified for 1.9.0.4 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.4pre) Gecko/2008102204 GranParadiso/3.0.4pre using the testcase on the site

Verified for 1.8.1.18 with Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.18pre) Gecko/2008102203 BonEcho/2.0.0.18pre.
Keywords: fixed1.8.1.18, fixed1.9.0.4 → verified1.8.1.18, verified1.9.0.4
Alias: CVE-2008-5023
Group: core-security

Updated

9 years ago
Flags: blocking1.8.0.next?

Updated

9 years ago
Blocks: 472648
No longer blocks: 472648
Depends on: 472648
You need to log in before you can comment on or make changes to this bug.