896255 - Execute a XPI cover by Title Even (spoofing/clickjacking)

Status: RESOLVED DUPLICATE of bug 884488

(Core :: General, defect)

Description

[Jordi Chancel]

Attachment: TESTCASE LOCAL 1

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0 (Beta/Release)
Build ID: 20130618035212

Steps to reproduce:


-Go to 2.html and don't move the mouse when there is on the link
-Press ENTER
(if you don't enderstand look this youtube video =>  http://www.youtube.com/watch?v=Q3O2Kn2xyPw&feature=youtu.be)


Actual results:

XPI is executed


Expected results:

Title even cover the XPI install box.

Comment 1

[Jordi Chancel]

Attachment: Windows exemple

Comment 2

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

:dveditz - is this bug related to the fix you mention in https://bugzilla.mozilla.org/show_bug.cgi?id=888842#c3

Comment 3

[Jordi Chancel]

it's not a duplicate ! see the poc it work with diferent elements.

Comment 4

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

(In reply to Jordi Chancel from comment #3)
> it's not a duplicate ! see the poc it work with diferent elements.

I did not say it was a duplicate, I am asking if the fixes are related. I would appreciate it if you could please not clear flags explicitly set for other people. Please allow us to do our work in our time frame and be patient as we try to do our jobs.

Comment 5

[Daniel Veditz [:dveditz]]

(In reply to Jordi Chancel from comment #1)
> Created attachment 778942 [details]
> Windows exemple

What format is this? It doesn't seem to be a .zip like the first attachment.

(In reply to Curtis Koenig [:curtisk] from comment #2)
> :dveditz - is this bug related to the fix you mention in
> https://bugzilla.mozilla.org/show_bug.cgi?id=888842#c3

Depends on how we fix it. Ultimately both rely on the fact that an important security dialog is allowing content above it. If that dialog is not the top-most thing on the screen it should not be "active".

Comment 6

[Jordi Chancel]

(In reply to Curtis Koenig [:curtisk] from comment #4)
> (In reply to Jordi Chancel from comment #3)
> > it's not a duplicate ! see the poc it work with diferent elements.
> 
> I did not say it was a duplicate, I am asking if the fixes are related. I
> would appreciate it if you could please not clear flags explicitly set for
> other people. Please allow us to do our work in our time frame and be
> patient as we try to do our jobs..

la prochaine fois que tu me parle comme sa tu ne pourra t'en prendre qu'a toi même je ne suis pas ton pote!

Comment 7

[Jordi Chancel]

I do not want to work with Curtis Koenig, he is not even able to confirm the vulnerability and write their severity, it slows down the work everyone!

Comment 8

[Jordi Chancel]

Attachment: Linux exemple

Comment 9

[Mats Palmgren (inactive)]

Attachment: linux-example (screenshot)

This is what I see when I follow the STR in FF23/Linux64 with a clean profile:
1. load 2.html
2. hover the mouse over the link on the page and wait

Nothing happens when I press Enter in this state (the Allow button
does not have focus).

Still, I suspect that the "wait 5 seconds and the press Enter"
is really meant for the Install button in the add-on installation
dialog, which makes me wonder -- how did you get past the Allow
button?

Comment 10

[Jordi Chancel]

On windows and linux after the addon loading (5seconds) the button "executed" is selectioned by default, when you press enter this addon is executed. it's not complicated.

Comment 11

[Jordi Chancel]

and title even cover the addon box. read previous message witch say : On windows and linux after the addon loading (5seconds) the button "executed" is selectioned by default, when you press enter this addon is executed. it's not complicated.

Comment 12

[Mats Palmgren (inactive)]

But the add-on installation dialog does not open unless you first click "Agree"
(see my screenshot).  Please test in a fresh profile and see for yourself.
(I get the same results on Windows 7)

Comment 13

[Mats Palmgren (inactive)]

I'm using http:// of course, maybe that's the difference?

Comment 14

[Jordi Chancel]

test this testcase localy please. my testcase work only localy on file:///

Comment 15

[Mats Palmgren (inactive)]

Ah OK, if I load the test using file:// then the initial Allow confirmation step
is skipped and I get directly to the installation dialog.  But that means the
PoC requires that the .xpi is already on my file system.

Comment 16

[Jordi Chancel]

yes bu he can be not visible on other folder on the zip

Comment 17

[Mats Palmgren (inactive)]

But you still have to convince the user to save some file to disk, then open
that file using file:// then follow the instructions on that page "hover the link,
wait 5 seconds, then press Enter".  It seems rather unlikely that anyone would
follow through performing all these steps without getting suspicious.

Comment 18

[Jordi Chancel]

i have never view a sec-low that allow code execution localy perfectly ! it's moderate or high , but it's not high it's moderate!!!

Comment 19

[Jordi Chancel]

That's not true - extensions have system privileges, so installing one without user consent is exactly arbitrary code execution.

Comment 20

[:Gavin Sharp [email: [e-mail]]]

Jordi, making your own modifications to the security rating or whiteboard is counter productive to what you are trying to achieve.

I agree that the end effect is severe, but because these testcases are difficult to get to work and very platform-specific, the severity is mitigated by the unreliability of the attack.

Comment 21

[Mats Palmgren (inactive)]

(In reply to Jordi Chancel from comment #16)
> yes bu he can be not visible on other folder on the zip

But if you ask the user to save a ZIP file, and then load that locally,
doesn't that trigger some external unzip process to be able to load the HTML
file inside?  (in addition to the steps in comment 17).  And if you're not
using a ZIP file, you'll have to convince the user to save *two* files?

Maybe you could write down the exact steps you think are the simplest
to download the PoC and launch it locally with file:// in the browser,
just in case we're missing something.

Comment 22

[Al Billings [:abillings - ex-MoCo]]

(In reply to :Gavin Sharp (use [e-mail] for email) from comment #20)
> Jordi, making your own modifications to the security rating or whiteboard is
> counter productive to what you are trying to achieve.

In fact, we've specifically told Jordi not to do this on his bugs on more than one occasion.

Jordi, if you keep doing this, we're going to have to remove some of your bugzilla privileges.

Comment 23

[Jordi Chancel]

i'm sorry.

Comment 24

[Al Billings [:abillings - ex-MoCo]]

Bug Bounty Triage: We're making bug 884488 the master bug for XPI clickjacking issues that you're reporting. They are all variants of the same basic problem.