[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <cf934b1c-e776-33a1-1e53-b8a0ea6a1840@free.fr>
Date: Thu, 5 Jan 2023 18:29:34 +0100
From: Gabriel Corona <gabriel.corona@...e.fr>
To: oss-security@...ts.openwall.com
Subject: Re: Code execution through MIME-type association of
Mono interpreter and security expectations of MIME type associations
Hi,
>> * Firefox and Thunderbird accept "special" MIME types (inode/* and
>> x-scheme-handler/*) from remote servers;
> Not sure what you mean by “accept”. Do you mean that download should be
> aborted?
No I mean that Firefox should ignore the Content-Type header for
choosing an application to handle the file when such a special MIME type
value is sent by the HTTP server.
Currently when using inode/directory or x-scheme-handler/trash,
Firefox/Thunderbird proposes to use a file manager to handle the file.
If the file manager tries to spawn another program to handle the file,
this might be used to trick the user into thinking he is opening the
file with a safe program.
A similar exploit might be possible if some application:
* is registered to handle a custom URI scheme (eg. "foo:");
* is not registered to handle regular files;
* can trigger arbitrary code execution when called with a regular file.
This might be expected to be safe. However an attacker might exploit
this by serving a malicious file with x-scheme-handler/foo: Firefox will
open the file using the application which will trigger the arbitrary
code execution.
Regards,
Gabriel
Download attachment "OpenPGP_signature" of type "application/pgp-signature" (841 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
