645699 - (CVE-2011-2370) A non-whitelisted site can trigger xpinstall

Status: VERIFIED FIXED

(Toolkit :: Add-ons Manager, defect)

Description

[moz_bug_r_a4]

http://mxr.mozilla.org/mozilla-central/source/toolkit/mozapps/extensions/content/extensions-content.js#93

93     install: function(aArgs, aCallback) {
94       if (!aArgs || typeof aArgs != "object")
95         throw new Error("Incorrect arguments passed to InstallTrigger.install()");
96 
97       var params = {
98         installerId: this.installerId,
99         mimetype: "application/x-xpinstall",
100         referer: this.window.location.href,
101         uris: [],
102         hashes: [],
103         names: [],
104         icons: [],
105       };

this.window is a SJOW.  And it's possible to redefine window.location.  Thus,
content code can control this.window.location.href.

Comment 1

[moz_bug_r_a4]

Attachment: testcase

This works on trunk.

Comment 2

[Boris Zbarsky [:bzbarsky]]

> this.window is a SJOW.

Gah.  Why?  :(

> 100         referer: this.window.location.href,

Yeah, window is not an XrayWrapper, that's just broken.

Comment 3

[moz_bug_r_a4]

(In reply to comment #2)
> > this.window is a SJOW.
> 
> Gah.  Why?  :(
> 

http://mxr.mozilla.org/mozilla-central/source/toolkit/mozapps/extensions/content/extensions-content.js#247

247     window.wrappedJSObject.__defineGetter__("InstallTrigger", function() {
...
253       delete window.wrappedJSObject.InstallTrigger;
254       var installTrigger = createInstallTrigger(window.wrappedJSObject);
255       window.wrappedJSObject.InstallTrigger = installTrigger;
256       return installTrigger;
257     });

We pass window.wrappedJSObject to createInstallTrigger.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Well, yes.  I understand why it's happening on a code level.  My question was why we're doing that.

Comment 5

[Henrik Skupin [:whimboo][⌚️UTC+2]]

This testcase doesn't work for me when you remove addons.mozilla.org from the whitelist in the preferences first. I don't see an Install Software dialog on each of the platforms. So what are your initial steps to get this failing?

Comment 6

[Boris Zbarsky [:bzbarsky]]

Henrik, addons.mozilla.org is in the whitelist by default, so we're vulnerable by default, no?

Comment 7

[moz_bug_r_a4]

Attachment: testcase 2 - without the trick

(In reply to comment #5)
> So what are your initial steps to get this failing?

This testcase shows that bugzilla.mozilla.org can't trigger xpinstall without
the trick.

Comment 8

[Henrik Skupin [:whimboo][⌚️UTC+2]]

(In reply to comment #6)
> Henrik, addons.mozilla.org is in the whitelist by default, so we're vulnerable
> by default, no?

Ok, something was broken early today on my system. Now I'm able to reproduce the reported behavior on OS X.

Comment 9

[Dave Townsend [:mossop]]

Attachment: patch rev 1

This stops us using the unwrapped window and also switches to using document.documentURIObject throughout. The testcase verifies that the page cannot bypass the whitelist anymore.

Comment 10

[Jesse Ruderman]

[sg:low] because you still get the dialog. You just bypass the infobar that non-AMO sites get.  The infobar is more of an anti-annoyance measure than a security measure.  You can attack the infobar with a UI timing attack anyway. Or, if your goal is to get the victim to install an AMO-hosted extension, you can attack the AMO web site in a similar manner.

Comment 11

[Dave Townsend [:mossop]]

If I land this as-is it's going to be pretty obvious what the issue is here. I assume because this is only sg:low that that isn't a big problem?

Comment 12

[Dave Townsend [:mossop]]

Landed: http://hg.mozilla.org/mozilla-central/rev/3578f5b22f6b

Comment 13

[Dave Townsend [:mossop]]

Comment on attachment 523069 [details] [diff] [review]
patch rev 1

Requesting approval to land this for the next 4.0.x release to close this small whole.

Comment 14

[LegNeato]

While it would be good to have, sg:low doesn't meet the bar for Macaw. This will be fixed in 5

Comment 15

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Verified fixed with Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0a2) Gecko/20110512 Firefox/5.0a2