h0wl h0wl

How HTML Injection Is Bad on Firefox OS

「Firefox OS Advent Calendar 2014」と「脆弱性"&'<<>\ Advent Calendar 2014」の12月20日の記事です。

先月報告したFirefox OSのHTMLインジェクションバグ(Bug 1101158 )について紹介します。このバグはFirefox OS Simulatorを含む一部の環境ではまだ修正されていませんが、リスク評価の上、Mozillaよりちょうど本日(！！)、公開の許可を頂き掲載しております。

HTML Injection on Firefox OS (Bug 1101158)

Firefox OS v2.1/v2.2には、端末のホームボタンを長押ししたときに表示されるカードビューに、HTMLインジェクションの可能な箇所がありました。カードビューとはアクティブなウィンドウの一覧を表示する機能なのですが、ウィンドウのタイトルにHTMLタグが含まれることが考慮されていませんでした。

Installing V8 on a Mac

Prerequisites

Install Xcode (Avaliable on the Mac App Store)
Install Xcode Command Line Tools (Preferences > Downloads)
Install depot_tools
- $ git clone https://chromium.googlesource.com/chromium/tools/depot_tools.git
- $ nano ~/.zshrc
- Add path=('/path/to/depot_tools' $path)

GeckoのlocalStorageについて調べてみた

これはFirefox OS Advent Calendar 2013 12/14の記事です。

こんにちは、にしむねあです。この記事ではGeckoのlocalStorageの実装を紹介します。私はセキュリティの分野に興味があるので、データのアクセス制御がどのように実装されているかを掘り下げてみたいと思います。

	interface AesGcmEncryptResult {
	readonly attribute ArrayBuffer ciphertext;
	readonly attribute ArrayBuffer tag;

	};

	interface BookmarkCollection {
	readonly attribute long length;

	any item(unsigned long index);

	It appears that Safari does not enforce any kind of access
	restrictions for XMLHTTPRequests on FILE: scheme URLs. As a
	result, any HTML file on the local file system that is opened in
	Safari can read any file that the user has access to (and, of
	course, it can upload those files too). Here's a little
	proof-of-concept. Copy and paste this into a local HTML file and
	open it in Safari. It will display the contents of /etc/passwd.

	<script src=https://code.jquery.com/jquery-2.1.3.min.js></script>
	<script>

	package sample;
	import java.util.*;

	public class ArrayTools
	{
	public static Integer[] Range(final int n, final int n2) {
	final Integer[] array = new Integer[n2 - n];
	for (int i = 0; i < array.length; ++i) {
	array[i] = n + i;
	}

	<!DOCTYPE HTML>
	<html>
	<script>
	function t()
	{
	var s="\n";
	var elements=new Array("a","abbr","acronym","address","applet","area","article","aside","audio","b","base","basefont","bdi","bdo","big","blockquote","body","br","button","canvas","caption","center","cite","code","col","colgroup","command","datalist","dd","del","details","dfn","dir","div","dl","dt","em","embed","fieldset","figcaption","figure","font","footer","form","frame","frameset","h1","h2","h6","head","header","hgroup","hr","html","i","iframe","img","input","ins","kbd","keygen","label","layer","legend","li","link","listing","main","map","mark","marquee","menu","meta","meter","nav","nobr","noembed","noframes","nolayer","noscript","object","ol","optgroup","option","output","p","param","plaintext","pre","progress","q","rp","ruby","rt","s","samp","script","section","select","small","source","span","strike","strong","style","sub","summary","sup","table","tbody","td","textarea","tfoot","th","thead","title","tr","track","tt","u","ul","v

	#!/usr/bin/env python2
	"""
	Author: takeshix <takeshix@adversec.com>
	PoC code for CVE-2014-0160. Original PoC by Jared Stafford (jspenguin@jspenguin.org).

	Supportes all versions of TLS and has STARTTLS support for SMTP,POP3,IMAP,FTP and XMPP.
	"""

	import sys,struct,socket
	from argparse import ArgumentParser

	/*
	* Naive hit tracer implementation using DynamoRIO.
	*
	* Author: axt
	*
	* Build it with the following commands:
	* gcc -Dbbhit_EXPORTS -DSHOW_RESULTS -DSHOW_SYMBOLS -fPIC -I../include -I../ext/include -DX86_64 -DLINUX -O2 -fno-stack-protector -o bbhit.c.o -c bbhit.c
	* gcc -fPIC -O2 -DX86_64 -DLINUX -fno-stack-protector -fPIC -shared -lgcc -Wl,--hash-style=both -shared -Wl,-soname,libbbhit.so -o libbbhit.so bbhit.c.o ../lib64/debug/libdynamorio.so.4.2 ../ext/lib64/debug/libdrsyms.so
	*/
	#include <stddef.h>