bugtraq - Firefox focus stealing vulnerability (possibly other browsers)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sun, 11 Feb 2007 21:00:45 +0100 (CET)
From: Michal Zalewski <lcamtuf@...ne.ids.pl>
To: bugtraq@...urityfocus.com
Cc: full-disclosure@...ts.grok.org.uk
Subject: Firefox focus stealing vulnerability (possibly other browsers)

There is an interesting logic flaw in Mozilla Firefox web browser.

The vulnerability allows the attacker to silently redirect focus of
selected key press events to an otherwise protected file upload form
field. This is possible because of how onKeyDown / onKeyPress events are
handled, allowing the focus to be moved between the two. If exploited,
this enables the attacker to read arbitrary files on victim's system.

This was tested with 2.0.0.1. Opera is most likely not vulnerable;
Microsoft Internet Explorer is not vulnerable as-is, but might be
vulnerable to a variant of the attack.

All INPUT TYPE=FILE form fields enjoy the benefits of added protection to
prvent scripts from arbitrarily choosing local files to be uploaded to the
server, and automatically submitting the form. For example, .value
parameter cannot be set or changed, and any changes to .type reset the
contents of the field.

Unfortunately, Firefox allows a malicious script to redirect carefully
selected, individual user keystrokes to a hidden file upload field, in
order to compose a particular filename, then submit the form. User
interaction is required, limiting the impact somewhat - but any website
where the user can be reasonably expected to enter some text (a
keyboard-controlled web game, a blog posting or commenting interface) can
attempt to exploit the vulnerability, and eventually succeed with one user
or another.

A quick and naive demonstration of the problem (Firefox on Windows is
required;  depends on scancode values, so not all keyboards may be
supported):

  http://lcamtuf.coredump.cx/focusbug/

(Ta-dah again)

/mz