572130 - Chrome code using dataTransfer.mozGetDataAt() leads to arbitrary code execution

Status: VERIFIED FIXED

(Core :: XPConnect, defect)

Description

[moz_bug_r_a4]

If a return value of dataTransfer.mozGetDataAt() is a content JS object, it is
not wrapped in a SJOW.  (If a return value is a content DOM object, it is
wrapped in an XPCNativeWrapper.)

Comment 1

[moz_bug_r_a4]

Attachment: testcase 1 - Arbitrary code execution

This works on Firefox trunk, 3.6.* and 3.5.*.

Comment 2

[moz_bug_r_a4]

Attachment: testcase 2 - Arbitrary code execution

This works on SeaMonkey trunk, 2.0.*, Firefox 3.6.* and 3.5.*.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

Comment 4

[Robert Sayre]

time to land?

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/890b78ea868d

Comment 6

[LegNeato]

Any hope for branch patches for this?

Comment 7

[LegNeato]

Talked to Blake about this one, we're going to punt for .7 & .11 as the fix uses a function that is not on the branches and we don't want the risk of backporting it at this time.

We'll want it for a future security update though.

Comment 8

[Daniel Veditz [:dveditz]]

Good thing we don't have 400 million people using vulnerable versions, guess we'll fix it next time. Next time being .14, seven releases after the comment 7 punt.

Comment 9

[Brandon Sterne (:bsterne)]

Blake, can I persuade you to work on a branch fix for this bug?  We have a working PoC for arbitrary chrome code execution.  We really should get this fixed ASAP.

Comment 10

[LegNeato]

Deferring to a future point release as we have run out of time. If this absolutely needs to be fixed and can land today or tomorrow, please send a note to [e-mail]

Comment 11

[Daniel Veditz [:dveditz]]

The one-year anniversary punting to the next release

Comment 12

[moz_bug_r_a4]

The old testcases no longer work due to the fix in bug 723808.  I'll attach a new testcase.

Comment 13

[moz_bug_r_a4]

Attachment: testcase 3 - arbitrary code execution

This uses bug 344495's trick.
This works on fx 3.6.x.

Comment 14

[Al Billings [:abillings - ex-MoCo]]

moz_bug_r, this probably isn't going to be fixed on 3.6.x at this point. Our last release was the final ever release, barring a chemspill.

Is there anything in this bug that affects current Firefox versions?

Comment 15

[moz_bug_r_a4]

(In reply to Al Billings [:abillings] from comment #14)
> Is there anything in this bug that affects current Firefox versions?

I think that there is nothing.

Comment 16

[Al Billings [:abillings - ex-MoCo]]

Marking as verified for trunk.

Comment 17

[Blake Kaplan (:mrbkap) (inactive)]

(I think these changes were accidental.)