58021 - Privileged code insertion with addPanel

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[Mitchell Stoltz (not reading bugmail)]

It is possible for a web script to run privileged code using
sidebar.addPanel("javascript: ... "), or potentially with a chrome: URL instead
of a javascript: URL. We should probably not allow sidebar panels to be
javascript: URLs, or else we should not give those urls the system principal.

The example above works on unix systems. It will execute /usr/bin/control-panel,
as an example. Change the 'executable' string in the script to C:\something.exe
to see this work on Windows.

The other possible scenario is asking the user do install an otherwise benign
skin, using the skin installer, which places some malicious .xul file somewhere
in the chrome directory. Then, the attacker convinces the user to click a link
which does an addPanel("chrome://navigator/skins/malicious.xul"), causing the
code in that malicious file to be run.

Comment 1

[Mitchell Stoltz (not reading bugmail)]

This is critical for RTM, I think.

Comment 2

[Mitchell Stoltz (not reading bugmail)]

Attachment: First approximation fix, needs work. Please comment.

Comment 3

[selmer (gone)]

Looks like you're working on this, adding [rtm need info] to the whiteboard.
Getting this approved soon seems like a Good Thing (TM) 

Comment 4

[Mike McCabe]

r=mccabe, looks like a simple fix.

Comment 5

[Mitchell Stoltz (not reading bugmail)]

Marking rtm+ in anticipation of sr= from Hyatt.

Comment 6

[David Hyatt]

a=hyatt

Comment 7

[Phil Peterson]

This bug is in candidate limbo.  We will reconsider this fix once we have a
candidate in hand, but we can't take this fix before then. Please check into the
trunk ASAP.

Comment 8

[Mitchell Stoltz (not reading bugmail)]

Adding InLimbo to status so this doesn't get overlooked.

Comment 9

[selmer (gone)]

rtm++, please checkin ASAP so we can build today.

Comment 10

[Mitchell Stoltz (not reading bugmail)]

Fix checked in.

Comment 11

[John Unruh]

Verified on Win, Mac and Linux branch 11/3 builds.

Comment 12

[John Unruh]

Mass changing QA to ckritzer.

Comment 13

[ckritzer (gone)]

Marking VERIFIED FIXED per:
------- Additional Comments From [e-mail] 2000-11-03 13:30 -------

Verified on Win, Mac and Linux branch 11/3 builds.