New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 618542 link

Starred by 1 user
Status: Duplicate
Owner: ----
Closed: Jun 2016
Cc:
█ jialiul@chromium.org
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: ----
Type: Bug-Security



Sign in to add a comment

Security: Save hidden executable in users computer using 'Save Page As'

Reported by iqaba...@gmail.com, Jun 9 2016 
VULNERABILITY DETAILS
If we reference a .exe using a link tag like:

<link rel="stylesheet" href="http://localhost/calc.exe" />

then we have the user 'CTRL+S' (save page as) and by default (I believe) its set to 'Web Complete' 

Tested on latest nightly. Also looks like google chrome has the same behavior, does not look like a safe and expected behavior.

VERSION
Chrome Version: [50.0.2661.102] + [stable]
Operating System: [Windows OS]

REPRODUCTION CASE
1.Host index.html on localhost and have the following:

<html><head><link rel="stylesheet" href="http://localhost/calc.exe" /></head><body></body></html>

2. Host a .exe file as well (calc.exe in this example)

3. visit http://localhost/index.html

4. hit 'CTRL+S' and by default it should show 'web complete' as type

5. after saving, the .exe executable is present in 'index_files' folder locally.

The only danger here is if the user opens the file himself. Or if in the future there was some sort of exploit that requires there to be an attacker controlled binary present.

We can potentially also have a .lnk or .url file be downloaded as well which point to the executable and have the user open our URL file by telling them this is where our website is or something. Successfully executing the application.

Comment 1 by nparker@chromium.org, Jun 10 2016

Cc: jialiul@chromium.org
Mergedinto: 599224
Status: Duplicate (was: Unconfirmed)
Thanks for the report!  This is a known issue.
Project Member

Comment 2 by sheriffbot@chromium.org, Sep 16 2016

Labels: -Restrict-View-SecurityTeam
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 3 by sheriffbot@chromium.org, Oct 1 2016 

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 4 by sheriffbot@chromium.org, Oct 2 2016 

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 5 by mbarbe...@chromium.org, Oct 2 2016

Labels: allpublic
►

Sign in to add a comment