664449 - URL bar introduces NUMEROUS vulnerabilities.

Status: RESOLVED INVALID

(Firefox :: Address Bar, defect)

Description

[Leon Kaiser]

User-Agent:       Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.25 Safari/534.24
Build Identifier: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.16) Gecko/20110323 Ubuntu/9.10 (karmic) Firefox/3.6.16 

I first read about it here: http://consumerist.com/2011/06/how-hackers-stole-200000-citi-accounts-by-exploiting-basic-browser-vulnerability.html

Then I got to thinking, what else can someone do with the URL bar?
* Run JavaScript.
* Browse local file directories.

Reproducible: Always

Steps to Reproduce:
1. Type `javascript:alert(document.cookie);' into the URL bar.
2. Type `file:///etc/passwd' into the URL bar.

Actual Results:  
1. My personal information was displayed.
2. The system password file was displayed.

Expected Results:  
1. Not have allowed this.
2. See above.

http://www.readwriteweb.com/archives/google_wants_to_kill_the_url_chrome_13_lets_users.php
Chrome is ridding the world of this evil, why can't Firefox?

Comment 1

[Leon Kaiser]

This is so bad that I'm using curl(1) to browse the web until this is fixed.

Comment 2

[:Gavin Sharp [email: [e-mail]]]

The URL bar allows you to load your own private information or XSS yourself, sure. That is not a security vulnerability in and of itself.

Remote web sites cannot take advantage of this to steal data, unless they convince you to paste a malicious javascript: URL into the location bar while you're viewing a sensitive page. We addressed that specific vulnerability in bug 656433, which will be fixed in Firefox 6 (due to be released in roughly 6 weeks).

Comment 3

[Lucas Adamski [:ladamski]]

Furthermore this has nothing to do with the article cited.  Citibank apparently failed to implement the most fundamental authorization check; there's no change to the URL bar could have mitigated this attack in any way.

That said, we are looking at mitigating pasting javascript: and data: URLs in the URL bar to address people being tricked into cutting & pasting bad stuff.

None of this applies to people who aren't manually cutting and pasting random junk into their URL bar.