oss-sec mailing list archives
Re: with firefox on X11, any page can pastejack you anytime
From: David Leadbeater <dgl () dgl cx>
Date: Fri, 20 Oct 2023 12:58:21 +1100
On Fri, 20 Oct 2023 at 09:55, Turistu <turistu () gmail com> wrote: [...]
It pretty much **is** mitigated at that layer. If xterm itself weren't filtering out the ESC (ascii 0x1b) character in the pasted data, then the bracketed-paste feature of bash or zsh could've been easily bypassed by inserting a "\x1b[201~" escape (= end of pasted data) in the payload. (As already mentioned in the report too).
I haven't tested all terminal and shell combinations, but the implementations of bracketed paste mode vary in their correctness, some do not filter all non-whitespace control characters, so for example you can add ^C into the exploit HTML: writeXPrimary('\u0003;touch ~/LOL-' + Date.now() / 1000 +'\r') Then you get a command being run with no interaction; this appears to work with xterm (384) + fish for example.
But there are a thousand more ways for an attacker to leverage that hole in Firefox. Many programs (including Firefox itself!) could be easily crashed by garbage data from the clipboard. Attacker-controlled data could find its way into shell scripts via `var=$(xsel)`, etc.
This isn't just limited to Firefox, one example is terminals that support OSC 52 (clipboard write), a remote SSH session can be hijacked and an attacker can inject OSC 52 into the stream in the background (I looked into this as part of my terminal security research, see [1]). As you point out there are many ways for untrusted data to end up on the clipboard, the attack vector here is via the terminal so my opinion is the terminal is what should protect against it. (Although I think Firefox could help with some defense-in-depth here, shame they don't want to.) For example two terminals that get this right are: - rxvt-unicode: The confirm-paste extension (loaded in the default set) pops up a confirmation when pasting control characters (not just newlines), "y" will strip controls, "p" will paste controls as is. - Windows Terminal: Strips non-whitespace control characters, asks for confirmation when pasting newlines, if bracketed paste mode is off. David [1]: https://dgl.cx/2023/09/ansi-terminal-security#xterm-osc-52-clipboard
Current thread:
- Re: with firefox on X11, any page can pastejack you anytime, (continued)
- Re: with firefox on X11, any page can pastejack you anytime Grant Taylor (Oct 18)
- Re: with firefox on X11, any page can pastejack you anytime Michael Orlitzky (Oct 18)
- Re: with firefox on X11, any page can pastejack you anytime Grant Taylor (Oct 18)
- Re: with firefox on X11, any page can pastejack you anytime Michael Orlitzky (Oct 18)
- Re: with firefox on X11, any page can pastejack you anytime Jan Engelhardt (Oct 18)
- Re: with firefox on X11, any page can pastejack you anytime Michael Orlitzky (Oct 18)
- Re: with firefox on X11, any page can pastejack you anytime Sam Bull (Oct 19)
- Re: with firefox on X11, any page can pastejack you anytime Steffen Nurpmeso (Oct 19)
- Re: with firefox on X11, any page can pastejack you anytime Sam Bull (Oct 19)
- Re: with firefox on X11, any page can pastejack you anytime Jeremy Stanley (Oct 19)
- Re: with firefox on X11, any page can pastejack you anytime Turistu (Oct 19)
- Re: with firefox on X11, any page can pastejack you anytime David Leadbeater (Oct 20)
- Re: with firefox on X11, any page can pastejack you anytime David Leadbeater (Oct 20)
- Re: with firefox on X11, any page can pastejack you anytime nightmare . yeah27 (Oct 20)
- Re: Re: with firefox on X11, any page can pastejack you anytime Steffen Nurpmeso (Oct 20)
- Re: with firefox on X11, any page can pastejack you anytime Grant Taylor (Oct 18)
- Re: with firefox on X11, any page can pastejack you anytime niekt0 (Oct 19)
- Re: with firefox on X11, any page can pastejack you anytime Jeffrey Walton (Oct 19)
- Re: with firefox on X11, any page can pastejack you anytime Solar Designer (Oct 20)
- Re: with firefox on X11, any page can pastejack you anytime Turistu (Oct 20)
- Re: with firefox on X11, any page can pastejack you anytime Martin Hecht (Oct 24)