721398 - (CVE-2012-0476) moz-page-thumb protocol should not be accessible from a web page

Status: VERIFIED FIXED

(Firefox :: General, defect)

Description

[teramako]

Attachment: page owner can know URLs are visited in past using img.onerror

User Agent: Mozilla/5.0 (Windows NT 5.1; rv:12.0a1) Gecko/20120126 Firefox/12.0a1
Build ID: 20120126031113

Steps to reproduce:

moz-page-thumb://thumbnail?url=.... can access from a web page.
It should access only in privileged site for security and privacy reason.

If can access on a web page, evil site owner can know that the user accessed or not the URL in past.

Comment 1

[Benjamin Smedberg]

Reported publicly in bug 721408, I'm going to open this up. It means we should fix immediately or back out bug 497543.

Comment 3

[Tim Taubert [:ttaubert] (inactive)]

(In reply to Benjamin Smedberg  [:bsmedberg] from comment #1)
> Reported publicly in bug 721408, I'm going to open this up. It means we
> should fix immediately or back out bug 497543.

Going to push the fix in a minute.

Comment 4

[Tim Taubert [:ttaubert] (inactive)]

Attachment: patch v1

Comment 5

[Marco Bonardo [:mak]]

Comment on attachment 591820 [details] [diff] [review]
patch v1

Review of attachment 591820 [details] [diff] [review]:
-----------------------------------------------------------------

::: browser/components/thumbnails/Makefile.in
@@ +17,5 @@
>  EXTRA_PP_JS_MODULES = \
>  	PageThumbs.jsm \
>  	$(NULL)
>  
> +#ifdef ENABLE_TESTS

File a bug to fix the tests, add a comment pointing to that bug.

Comment 6

[Tim Taubert [:ttaubert] (inactive)]

https://hg.mozilla.org/mozilla-central/rev/7cdb5f5d38c6

Comment 7

[Paul Silaghi, QA [:pauly]]

Could you please tell me how to test this ?

Comment 8

[Tim Taubert [:ttaubert] (inactive)]

You can open about:newtab and right-click to inspect the document. Now the .newtab-thumbnail elements have a background-image set. This should look like "moz-page-thumb://thumbnail?url=http%3A%2F%2Fwww.reddit.com%2F".

If you now create a custom web page like data:text/html,<img src="moz-page-thumb://thumbnail?url=http%3A%2F%2Fwww.reddit.com%2F"/> the image should be broken because it's a normal content web page (i.e. without chrome privs).

Comment 9

[Virgil Dicu [:virgil] [QA]]

Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:12.0) Gecko/20100101 Firefox/12.0
Mozilla/5.0 (Windows NT 6.1; rv:12.0) Gecko/20100101 Firefox/12.0
Mozilla/5.0 (X11; Linux i686; rv:12.0) Gecko/20100101 Firefox/12.0

Verified in Firefox 12 beta 6. The image is now broken when attempting to load it.

Comment 10

[Al Billings [:abillings - ex-MoCo]]

Verified in trunk with Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:14.0) Gecko/20120418 Firefox/14.0a1.