Message-ID: <00c001ca5e7a$bd1b1450$37513cf0$@com>
Date: Thu, 5 Nov 2009 16:47:37 -0800
From: "Inferno" <Inferno@...ureThoughts.com>
To: <full-disclosure@...ts.grok.org.uk>
Subject: Using Blended Browser Threats involving Chrome to
	steal files on your computer

For complete post with images, please visit
http://securethoughts.com/2009/11/using-blended-browser-threats-involving-ch
rome-to-steal-files-on-your-computer/

SECURETHOUGHTS.COM ADVISORY
=============================================
- CVE-ID		: CVE-2009-XXXX (Chrome) {Pending}
- Release Date	: November 05, 2009
- Severity		: Medium
- Discovered by	: Inferno
=============================================

I. TITLE
-------------------------
Using Blended Browser Threats involving Chrome to steal files on your
computer

II. VULNERABLE
-------------------------
Chrome all versions < 3.0.195.32
Tests performed on v3.0.195.25

III. BACKGROUND
-------------------------
Google Chrome is a web browser released by Google which uses the WebKit
layout engine and application framework. It is one of the four most popular
browsers in the market today. Google released the entire source code of
Chrome, including its bespoke V8 JavaScript engine as an open source project
entitled Chromium, in 2008. Google Chrome is best known for its fast speed,
simplicity and reliability.

IV. DESCRIPTION
-------------------------
Google Chrome has an inbuilt file downloader[1], just like every other
browser. However, the behavior of this function is different from other
browsers and provides users much more usability and convenience. Chrome
automatically downloads a file from any site that is passed using the
Content-Disposition header value "attachment" (on the contrary, all other
browsers show a save as dialog). There are some mitigations done by Chrome
to protect users from auto downloading malware by raising an alert on
executable extensions such as .exe, .htm, .jar, etc.

The vulnerability arises from the fact that there are other extensions such
as .svg, .mht, .mhtml that don't exist in the Chrome's malicious extension
blacklist and hence the user never gets a warning message before they are
auto downloaded to his or her computer. If these downloaded files are
clicked from the Chrome's download bar or Windows Explorer (which the user
is highely likely to click considering his or her trust in Chrome that it
warns for malicious extensions), they will automatically get opened in other
browsers and can be used to steal any file on the user's computer.

The reason for the name "Blended Browser Threats" is because here, Google
Chrome is used as a vehicle for attack, whereas the real vulnerability
executes inside other browsers such as IE6, Safari on your computer. The
vulnerability is not directly exploitable in IE6, Safari since an evil site
cannot automatically download content on your computer without your
permission. Another important point to note here is you might not be using
the browsers IE6, Safari and instead using Chrome. But clicking a particular
file on Chrome's download bar can make it automatically open in IE6, Safari.
See the proof of concept examples below.

V. PROOF OF CONCEPT
-------------------------
1. The MHT, MHTML (MIME HTML) file format is used by Internet Explorer to
embed all external resources, usually images, in a single document.
Basically, whenever you click "Save As" on a web page, this is the default
format used to save it. So, MHT, MHTML files gets automatically opened in IE
when clicked. The exploit I want to discuss is interesting in the context of
IE6 (estimated to be installed on roughly 25% of the computers). For other
newer versions like IE7, IE8, the user is explicitly prompted about the
danger of executing javascript and hence much harder to exploit.

An evil site opened inside Chrome can automatically download a MHT/MHTML
file to your computer. If the user clicks on this downloaded file from the
Chrome's download bar or opens this file through Windows Explorer, it gets
automatically opened in IE6. The malicious script executes and can be used
to send any of your local files to a remote evil destination. Ex: Click on
this link-

http://securethoughts.com/security/chromelocalfilexss/chromedownload.php?fna
me=WATCHMENAKED.mhtml
(Image)
 
2. The SVG(Scalable Vector Graphics) file is a registered extension in some
Safari versions and hence a SVG file gets automatically opened in Safari. If
you ever had an older version of Safari on your computer, this extension
will be most probably there in your registry. Hence, it does not matter what
your current version of Safari is (and you may very well be using the latest
version of Safari). So the exploit works like this:

An evil site opened inside Chrome can automatically download a SVG file to
your computer. If the user clicks on this downloaded file from the Chrome's
download bar or opens this file through Windows Explorer, it gets
automatically opened in Safari. The malicious script executes and can be
used to send any of your local files to a remote evil destination. Ex: Click
on this link-

http://securethoughts.com/security/chromelocalfilexss/chromedownload.php?fna
me=WATCHMENAKED.svg
(Image)
 
3. An evil site opened inside Chrome can automatically download
inappropriate content such as a por_ographic image to your computer. Ex:
Click on this link-

http://securethoughts.com/security/chromelocalfilexss/chromedownload.php?fna
me=WATCHMENAKED.jpg
(Image)
 

VI. FIX DESCRIPTION
-------------------------
Google Chrome Team fixed this vulnerability by appending these dangerous
extensions such as .mht, .mhtml, .svg, etc to already existing extension
blacklist.
Check out the fixes done in Chromium Source Code here [2,3].

Chrome Team is also actively looking how to improve this mechanism in the
long run, but because of the need to maintain compatibility with certain
existing uses, this needs to be done carefully.

VII. SOLUTION
-------------------------
Chrome: Upgrade to latest version of Google Chrome (v3.0.195.32 or higher).
If you remain connected to the internet, this should be automatic.

The more secure solution is to configure your browser to prompt you
explicitly before downloading any file type. This can be done by going to
Chrome Configuration Options -> Under the Hood -> Check the 'Ask where to
save each file before downloading' flag.

VIII. References
-------------------------
1. Downloads: Downloading a file - Google Chrome Help
http://www.google.com/support/chrome/bin/answer.py?hl=en&answer=95759

2. Google Chrome Code Fix 1
http://codereview.chromium.org/243115

3. Google Chrome Code Fix 2
http://codereview.chromium.org/261022

4. Interesting Reads - thanks to Michal.
(a) Security in Depth: Local Web Pages - Adam Barth
http://blog.chromium.org/2008/12/security-in-depth-local-web-pages.html

(b) Same-Origin Policy:Browser Security Handbook - Michal Zalewski
http://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy

IX. CREDITS
-------------------------
This vulnerability is discovered by
Inferno (inferno {at} securethoughts {dot} com)

X. DISCLOSURE TIMELINE
-------------------------
Oct 5, 2009 12:14 AM: Vulnerability reported to Google Security Team.
Oct 6, 2009 11:19 AM: Automated Response from Google Security Team.
Oct 6, 2009 01:46 PM: First Status update provided by Michal Zalewski.
Vulnerability confirmed.
Oct 6, 2009 11:33 PM: Second Status update provided by Michal Zalewski. Code
Fix 1 checked in by Adam Barth.
Oct 8, 2009 12:30 AM: Code Fix 2 checked in by Adam Barth.
Nov 5, 2009 01:18 PM: Chrome v3.0.195.32 Released containing the Security
Patch.

I would like to thank Michal Zalewski and Adam Barth from Google for their
prompt responses and getting the patch ready in a timely manner. It was a
pleasure working with them. I am grateful to Google for providing credit for
my research by listing me on their "We Thank You" Page
(http://www.google.com/corporate/security.html).

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists