Issue metadata
Sign in to add a comment
|
Security: Universal XSS using a FrameNavigationDisabler bypass
Reported by
marius.mlynski@gmail.com,
Mar 24 2016
|
||||||||||||||||||||||
Issue description
VULNERABILITY DETAILS
When a top-level navigation is triggered on a frame displaying the initial empty document, FrameLoader::load is invoked directly:
----------------
void LocalFrame::navigate(Document& originDocument, const KURL& url, bool replaceCurrentItem, UserGestureStatus userGestureStatus)
{
(...)
if (isMainFrame() && !m_loader.stateMachine()->committedFirstRealDocumentLoad()) {
FrameLoadRequest request(&originDocument, url);
request.resourceRequest().setHasUserGesture(userGestureStatus == UserGestureStatus::Active);
m_loader.load(request);
} else {
m_navigationScheduler->scheduleLocationChange(&originDocument, url.getString(), replaceCurrentItem);
}
}
----------------
As a result, FrameNavigationDisabler will fail to prevent the navigation when the URL is loaded synchronously.
VERSION
Chrome 49.0.2623.87 (Stable)
Chrome 50.0.2661.49 (Beta)
Chrome 51.0.2687.0 (Dev)
Chromium 51.0.2690.0 + Pepper Flash (Release build compiled today)
,
Mar 24 2016
I'm unable to repro the test case with 50.0.2652.0 (Official Build) dev-m (64-bit): I just get the alert "this should never happen", even if I increased the timeout before calling go(). I have plugins unconditionally allowed, so I'm not sure what else I'm missing.
,
Mar 24 2016
This is odd, I haven't seen a single failure in the testing phase (all versions, Linux/Windows/VM/no VM, over 100 runs). I assume you're running the exploit from an HTTP server, can you verify that |location.href.split('exploit.html')[0] + 's.swf'| matches the actual location of the swf file? I'll have a closer look tomorrow and try to provide a debug version to pinpoint the problem.
,
Mar 25 2016
I can get the alert from the test target domain when running off a web server.
,
Mar 25 2016
,
Mar 25 2016
,
Mar 28 2016
For future reference, the easiest way to test with PPAPI flash: out/Release/chrome --ppapi-flash-path=/opt/google/chrome-unstable/PepperFlash/libpepflashplayer.so --ppapi-flash-version=21.0.0.193
,
Mar 29 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/f93a0e557dd97cc83d8b55953c2f57c5e2dfe07b commit f93a0e557dd97cc83d8b55953c2f57c5e2dfe07b Author: dcheng <dcheng@chromium.org> Date: Tue Mar 29 00:16:20 2016 Always ignore navigation in Document::detach() in LocalFrame::navigate() We already checked that FrameNavigation is enabled before trying to schedule a LocationChange; however, it was possible to construct a scenario with an opened window that would use the sync loading path and bypass this check. BUG= 597532 Review URL: https://codereview.chromium.org/1840813002 Cr-Commit-Position: refs/heads/master@{#383627} [modify] https://crrev.com/f93a0e557dd97cc83d8b55953c2f57c5e2dfe07b/third_party/WebKit/Source/core/frame/LocalFrame.cpp
,
Mar 29 2016
,
Mar 29 2016
,
Mar 29 2016
,
Mar 29 2016
[Automated comment] Request affecting a post-stable build (M49), manual review required.
,
Apr 4 2016
tinazh@ / sshruthi@ - please approve for M49 (as there's likely to be one next week AFAICT) and M-50.
,
Apr 4 2016
Your change meets the bar and is auto-approved for M50 (branch: 2661)
,
Apr 5 2016
I think this patch may be superseded by https://codereview.chromium.org/1858833003. Let me see how the review on that goes.
,
Apr 5 2016
Merge approved for M49 (branch 2623)
,
Apr 5 2016
I'm clearing the merge requests on this. We should merge the fix in 600182 instead, as it addresses this bug as well as the new UXSS.
,
May 23 2016
,
May 25 2016
:D Thanks!
,
Jun 17 2016
,
Jun 17 2016
,
Jul 5 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 1 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 2 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 2 2016
,
Apr 25 2018
|
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by wfh@chromium.org
, Mar 24 2016Components: UI>Browser>Navigation
Owner: dcheng@chromium.org