59208 - Can enumerate properties of a window in another domain

Status: VERIFIED FIXED

(Core :: Security: CAPS, defect, P2)

Description

[Jesse Ruderman]

1. Load attachment
2 [details] [diff] [review]. Hit "open calculator"
3. Hit "list properties"

Result: all enumerable properties of the new window are listed, including 
variables and functions on the calculator page (such as htmlEscape and pi).

4. Type nuclearBombOutput=30+10 into the calculator
5. Hit the "list properties" button again

Result: the string nuclearBombOutput (but not its value, 40) is available to 
the first window.


I don't think you'd be able to steal passwords or cookies using this trick, but 
you could probably tell whether the user has an account at some sites, or tell 
whether they're doing anything in the new window.  You can tell whether the 
user uses a bookmarklet in the new window, if the bookmarklet sets variables 
when it is used.

I haven't tested this with frames (instead of window.open).

Comment 1

[Jesse Ruderman]

Attachment: demonstration

Comment 2

[Jesse Ruderman]

NS 4.75 is vulnerable to this attack; IE says access denied.

Comment 3

[Mitchell Stoltz (not reading bugmail)]

Looks to me like you can enumerate the properties of the Window object but not
any sub-properties, and you can't actually read the value of any of those
properties. The only information leakage I see is being able to tell the names
of window-global vars defined by scripts on that page, and this is minor. Am I
missing something?

I think the solution, if we wanted to fix this, would be to apply
CheckScriptAccesss to the for - in statement, so that if you can't read the
value of a property, you can't enumerate it either. I'm not sure this is worth
the work it would require, but if you disagree then please give me reasons, or
better still, send me a patch.

Comment 4

[Jesse Ruderman]

Right, this just lets you look at global variables on the page.  The check 
would have to happen in propertyIsEnumerable and other similar functions as 
well as in for-in loops.

Comment 5

[John Unruh]

Mass changing QA to ckritzer.

Comment 6

[Mitchell Stoltz (not reading bugmail)]

Wontfix unless someone (Jesse?) demonstrates that this is more dangerous than it
appears to me right now. I don't think there's a major information leak here.

Comment 7

[Jesse Ruderman]

Attachment: demonstration: page tells you whether you're logged into nytimes.com

Comment 8

[Jesse Ruderman]

Reopening.  I can quietly find out whether a visitor to my site is logged into 
any site that does all of the following:

1. uses login cookies;
2. shows a different page, or redirects to a different page, iff you're not 
logged in;
3. has different (global) javascript functions on the "please log in" page and 
the normal page.

Comment 9

[Jesse Ruderman]

Un-futuring since I reopened this bug.

Comment 10

[Mitchell Stoltz (not reading bugmail)]

Mass adding mozilla0.9 keyword (mass changing milestone doesn't seem to work).

Comment 11

[Mitchell Stoltz (not reading bugmail)]

Mass changing milestone to Moz1.0 - stuff targeted for late spring/early summer.

Comment 12

[Mitchell Stoltz (not reading bugmail)]

Target is now 0.9.4, Priority P2.

Comment 13

[Mitchell Stoltz (not reading bugmail)]

Attachment: Patch take 1 - crashes.

Comment 14

[Mitchell Stoltz (not reading bugmail)]

Attachment: Patch v2 - still crashes when the enumeration is destroyed. See bug 97555.

Comment 15

[Mitchell Stoltz (not reading bugmail)]

We have a fix for 97555. If this patch and the ones in that bug are checked in
concurrently, we'll be golden.

Comment 16

[John Bandhauer]

sr=jband

This looks right to me. I suggest you get a review from jst to confirm that this
fits his scheme.

Comment 17

[Johnny Stenback (:jst)]

Add a space before 'if' at:

-  NS_ERROR("Don't call me!");
+ if (!sSecMan)
+    return NS_OK;

and I'm ok with this, r=jst

Comment 18

[Asa Dotzler [:asa]]

Comment on attachment 47608 [details] [diff] [review]
Patch v2 - still crashes when the enumeration is destroyed. See bug 97555.

a=asa on behalf of drivers

Comment 19

[Mitchell Stoltz (not reading bugmail)]

Fixed.

Comment 20

[bsharma]

Verified on
build: 2001-09-13-0.9.4
platform: Win NT

Both the test attachments work as expected.
1. http://bugzilla.mozilla.org/showattachment.cgi?attach_id=18769
For above test, when clicked on the "list properties" an error is written is the
JS console "Error: uncaught exception: Permission denied to get property
Window.enumerateProperties". And on the 1st window only name "ObjectWindow" appears.
2. http://bugzilla.mozilla.org/showattachment.cgi?attach_id=20957
For above test, error message appears on the browser window where the nytimes
page is loaded, "Got error while trying to enumerate propeties of nytArticle:
Permission denied to get property Window.enumerateProperties".