765430 - XSS in jsonrpc.cgi on IE6/7

Status: RESOLVED INVALID

(Bugzilla :: WebService, defect)

Description

[Mario Gomes]

User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1171.0 Safari/537.1

Steps to reproduce:

Hi,

Bugzilla does not escape bad chars on json response. This can allow xss attacks on IE.

PoC: https://landfill.bugzilla.org/bugzilla-tip/jsonrpc.cgi/?method=User.get&params="<iframe%20onload=alert('XSS')>":"aa"&a.html

Tested on IE 6.

Patch this is convert dangerous to javascript.

Cheers,
Mario.

Comment 1

[Reed Loden [:reed]]

This sounds like big fail on IE's part (especially with regards to the ending ".html" causing it to render. Not sure we can (or want to) do much here.

http://blog.watchfire.com/wfblog/2011/10/json-based-xss-exploitation.html has more detail.

Comment 2

[Mario Gomes]

So, will you ignore it? This is not exploitable on IE8+ due to header X-content-type-options:nosniff. But still exploitable on IE6/7. Patch it is just replace "<" to "\u003c", ">" to  "\u003e" and "&" to "\u0026". 

This is not the first time that this happens, you already patched a similar flaw on bug 637981. So, why ignore it?

Comment 3

[Frédéric Buclin]

I cannot reproduce the XSS attack, because the page is downloaded locally before being opened, and so you cannot do any harm. I also had to write jsonrpc.cgi? instead of jsonrpc.cgi/? else IE doesn't recognize "jsonrpc" at all.


Note that the whole error message is:

Could not parse the 'params' argument as valid JSON. Error: garbage after JSON object, at character offset 30 (before \":\"aa\"\") at Bugzilla/WebService/Server/JSONRPC.pm line 155. at Bugzilla/WebService/Server/JSONRPC.pm line 155 eval {...} called at Bugzilla/WebService/Server/JSONRPC.pm line 154 Bugzilla::WebService::Server::JSONRPC::retrieve_json_from_get('Bugzilla::WebService::Server::JSONRPC=HASH(0xa59b320)') called at /usr/lib/perl5/vendor_perl/5.14.2/JSON/RPC/Legacy/Server.pm line 110 JSON::RPC::Legacy::Server::handle('Bugzilla::WebService::Server::JSONRPC=HASH(0xa59b320)') called at /var/www/html/bugzilla/jsonrpc.cgi line 27

Comment 4

[Mario Gomes]

I got it on chrome.

{"error":{"message":"Could not parse the 'params' argument as valid JSON. Error: Value: \"<iframe onload=alert('XSS')>\":\"aa\"","code":32000},"id":"https://landfill.bugzilla.org/bugzilla-tip/","result":null}

Comment 5

[Mario Gomes]

Attachment: Screenshot of XSS on IE6.

Comment 6

[Mario Gomes]

What version have you tested?

(In reply to Frédéric Buclin from comment #3)
> I cannot reproduce the XSS attack, because the page is downloaded locally
> before being opened, and so you cannot do any harm. I also had to write
> jsonrpc.cgi? instead of jsonrpc.cgi/? else IE doesn't recognize "jsonrpc" at
> all.
> 
> 
> Note that the whole error message is:
> 
> Could not parse the 'params' argument as valid JSON. Error: garbage after
> JSON object, at character offset 30 (before \":\"aa\"\") at
> Bugzilla/WebService/Server/JSONRPC.pm line 155. at
> Bugzilla/WebService/Server/JSONRPC.pm line 155 eval {...} called at
> Bugzilla/WebService/Server/JSONRPC.pm line 154
> Bugzilla::WebService::Server::JSONRPC::retrieve_json_from_get('Bugzilla::
> WebService::Server::JSONRPC=HASH(0xa59b320)') called at
> /usr/lib/perl5/vendor_perl/5.14.2/JSON/RPC/Legacy/Server.pm line 110
> JSON::RPC::Legacy::Server::handle('Bugzilla::WebService::Server::
> JSONRPC=HASH(0xa59b320)') called at /var/www/html/bugzilla/jsonrpc.cgi line
> 27

Comment 7

[Frédéric Buclin]

(In reply to Mario Gomes from comment #6)
> What version have you tested?

IE6 and IE9.

Comment 8

[Mario Gomes]

As I told before this works only on IE6/7(in this version there is no X-content-type-options).


(In reply to Frédéric Buclin from comment #7)
> (In reply to Mario Gomes from comment #6)
> > What version have you tested?
> 
> IE6 and IE9.

Comment 9

[Mario Gomes]

As I told before this works only on IE6/7(in this version there is no X-content-type-options).


(In reply to Frédéric Buclin from comment #7)
> (In reply to Mario Gomes from comment #6)
> > What version have you tested?
> 
> IE6 and IE9.

Comment 10

[Frédéric Buclin]

The URL that reed posted in comment 1 shows that all versions of IE are affected, not only IE6 and 7. And in comment 7, I mentioned IE6.

Comment 11

[Mario Gomes]

Sure, this could be explored in all IE versions, but since Bugzilla uses X-content-type-options this is not possible on IE8/9/10.

(In reply to Frédéric Buclin from comment #10)
> The URL that reed posted in comment 1 shows that all versions of IE are
> affected, not only IE6 and 7. And in comment 7, I mentioned IE6.

Comment 12

[Frédéric Buclin]

I don't know how your IE browser is configured, but both IE6 and IE9 first download the HTML page locally before opening it, which means that the iframe is executed locally and so is not exploitable. If this is the default behavior, then this means you deactivated some security restrictions.

Do you have a real PoC which works rather than the harmless alert('XSS') popup?

Comment 13

[Mario Gomes]

Attachment: jscod.js

Comment 14

[Mario Gomes]

Someone here is able to trigger it?

Try it: https://landfill.bugzilla.org/bugzilla-tip/jsonrpc.cgi/.html?method=User.get&params="<script>alert(location.href)</script>":"aa"

Comment 15

[Mario Gomes]

@Byron, Reed: Are you able to reproduce it?

Comment 16

[Frédéric Buclin]

(In reply to Mario Gomes from comment #14)
> Someone here is able to trigger it?
> 
> Try it:
> https://landfill.bugzilla.org/bugzilla-tip/jsonrpc.cgi/.html?method=User.
> get&params="<script>alert(location.href)</script>":"aa"

IE6 complains that it cannot download "aa". Looks like this PoC doesn't work either.

Comment 17

[Mario Gomes]

Can you attach a screenshot? I really don't undestand why you cannot reproduce it,  I can do it easy.


(In reply to Frédéric Buclin from comment #16)
> (In reply to Mario Gomes from comment #14)
> > Someone here is able to trigger it?
> > 
> > Try it:
> > https://landfill.bugzilla.org/bugzilla-tip/jsonrpc.cgi/.html?method=User.
> > get&params="<script>alert(location.href)</script>":"aa"
> 
> IE6 complains that it cannot download "aa". Looks like this PoC doesn't work
> either.

Comment 18

[Frédéric Buclin]

Attachment: screenshot - IE6

IE 6 is unable to download anything.

Comment 19

[Mario Gomes]

That's Strange, I keep be able to reproduce. Is there someone else that got this problem too?

(In reply to Frédéric Buclin from comment #18)
> Created attachment 634498 [details]
> screenshot - IE6
> 
> IE 6 is unable to download anything.

Comment 20

[Mario Gomes]

Frederic, look this screenshot on IE7.

Comment 21

[Mario Gomes]

Attachment: Screenshot on IE7(win xp).

Comment 22

[Frédéric Buclin]

(In reply to Mario Gomes from comment #20)
> Frederic, look this screenshot on IE7.

I don't see how this is related to this bug. You are just trying to abuse IE7 using a well-known trick. IE8 and newer are no longer vulnerable to this problem.

Also, please don't use bmo for your tests. You generate bugmails uselessly.

Comment 23

[Mario Gomes]

I'm justing trying show that I can reproduce this bug(that does not seems to be taken seriously) on IE7 with default config.

Comment 24

[Mario Gomes]

Frederic, can you explain what's the difference of https://landfill.bugzilla.org/bugzilla-tip/ for https://landfill.bugzilla.org/bugzilla-4.2-branch/?. Vulnerabilities found in this channel is valid like on https://landfill.bugzilla.org/bugzilla-tip/?

Comment 25

[Mario Gomes]

Long time, no fix. Nobody will fix this? And can this be eligible for a bounty? ;)

Comment 26

[Mario Gomes]

Closing... bug ignored...

Comment 27

[Reed Loden [:reed]]

Seems like the patch in bug 243764 may "fix" this on trunk... Can somebody confirm?

Comment 30

[Mario Gomes]

Just a tip, you can fix this by adding "Content-Disposition: attachment", it'll not allow the page be view directly by browser.

Comment 31

[Frédéric Buclin]

I already asked you to stop playing with bmo. Use landfill for your tests.

Comment 32

[Mario Gomes]

Doesn't work anymore.

Comment 33

[Frédéric Buclin]

IE 6 and 7 are no longer supported, and the reporter says this issue no longer works.