622012 - News uris allow you to execute arbitrary commands on server

Status: RESOLVED WORKSFORME

(MailNews Core :: Networking: NNTP, defect)

Description

[Joshua Cranmer [:jcranmer]]

If you have an email with an image with the following href:
<news://news.mozilla.org/mozilla.dev.apps.thunderbird?search/CAPABILITIES>, CAPABILITIES will be executed on the server. You can also click on a link with the same href to execute the command.

The best way to fix this would probably be to rewrite the search URI semantics to not execute the actual command.

I don't know if this is security-sensitive or not, though.

Comment 1

[Daniel Veditz [:dveditz]]

Is that syntax for news:// new? or have we always exposed servers this way?

Comment 2

[Joshua Cranmer [:jcranmer]]

The ?search has been around for a very long time, if that is what you are asking:
<http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/mailnews/news/src/nsNNTPProtocol.cpp&rev=1.1&mark=2755-2794#2755>.

Comment 3

[Ludovic Hirlimann [:Usul]]

I don't think it should stay security sensitive as it' not an attack vector at least for tb. Could it be used as way to attack servers ?

Comment 4

[Daniel Veditz [:dveditz]]

If it's a problem for the server then it seems they'd be open to attack from custom (malicious) clients, in which case the worst might be recruiting unwitting MailNews users into a distributed attack on the server.

Won't servers have to already protect against this if it's a problem?

Comment 5

[Joshua Cranmer [:jcranmer]]

To clarify the situation: the news: URI that causes this problem is an extension of core mailnews to the official standard (RFC 5538)--the URI documents do not do anything with query portions except to note that it sometimes serves internal purposes.

Comment 6

[Kai Engert [:KaiE:]]

I don't understand why this is an issue in Thunderbird.

Servers should protect themselves.
Does this bug suggest that TB shouldn't execute queries that could trigger bad behavior on an NNTP server?

Comment 7

[Joshua Cranmer [:jcranmer]]

What would fix this bug would be to change the handling of search URIs to not put the entire command in the URI parameter. Or kill the URL-based state machine altogether, but that's rather more invasive.

Comment 8

[Hartmut Welpmann [:welpy-cw]]

The way 'news:' URIs are now handled, this doesn't seem to be possible anymore. See MailUtils.handleNewsUri() and BaseMessageService.getUrlForUri().

Comment 9

[Hartmut Welpmann [:welpy-cw]]

nsINntpUrl::ActionSearch is basically unused now, since a server search is started directly without such a URL, see BaseMessageService.search().