560313 - (WH-1628155) Content Spoofing Possible in tiki-view_forum.php

Status: RESOLVED FIXED

(support.mozilla.org :: Forum, task)

Description

[Michael Coates [:mcoates] (acct no longer active)]

Issue

User controlled data from the URL is inserted into the page content within tiki-view_forum.php. This creates a content spoofing vulnerability where an attacker could craft a link which results in lewd or phishing messages which appear to originate from the support.mozilla.com website.

Steps to reproduce:
1. Authenticate to support.mozilla.com
2. Follow this URL:
https://support.mozilla.com/tiki-view_forum.php?locale=en-US&comments_offset=0&comments_threadId=0&comments_threshold=0&thread_sort_mode=lastPost_desc&forumId=1&forum_advanced_post=y&comment_topictype=n&comments_data=advanced%20post%20in%20use&plugins=Content Spoofing Here&comments_title=&fx_version=userfile1=&anonymous_name=&anonymous_email=&comments_postComment=Post&comments_previewComment=Preview&comments_postCancel=Cancel
3. Observe that the page includes the arbitrary text from the URL argument "plugins". In this example you will see "Content Spoofing Here" displayed on the returned page.

Example #2 - Instructing user to visit third party page:

https://support.mozilla.com/tiki-view_forum.php?locale=en-US&comments_offset=0&comments_threadId=0&comments_threshold=0&thread_sort_mode=lastPost_desc&forumId=1&forum_advanced_post=y&comment_topictype=n&comments_data=advanced%20post%20in%20use&plugins=Please%20visit%20http://phishingsite.com&comments_title=&fx_version=userfile1=&anonymous_name=&anonymous_email=&comments_postComment=Post&comments_previewComment=Preview&comments_postCancel=Cancel

Recommended Remediation
The goal is to eliminate the ability for an attacker to control the text displayed within the returned page. This may be accomplished by creating a whitelist of allowed text for the "plugins" url argument. If a value is received that is not in the whitelist then an error is returned. However, this only works if the list of valid values is known and finite. 

An alternative method is to move away from using a string value and instead using an integer value which is mapped on the server side to the appropriate string value.  In this approach we would need input validation to protect the entry point of the string (e.g. to prevent an attacker from just inserting the string and then referring to it by the integer)

At a minimum, use output encoding to prevent the creation of any valid HTML from the user controlled data (e.g. see example #2 above)

Comment 1

[Michael Coates [:mcoates] (acct no longer active)]

Any updates on this issue? Who should this be assigned to?

Comment 2

[James Socol [:jsocol, :james]]

This code is gone.

Comment 3

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

unhiding bug