New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 875194 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Closed: Aug 22
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Chrome , Mac , Fuchsia
Pri: 2
Type: Bug-Security



Sign in to add a comment

Malicious download && code injection attack in <audio> element

Reported by tiebuc...@gmail.com, Aug 17

Issue description

UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36

Steps to reproduce the problem:
Exploit 1:
When user click download button from the audio player,the browser will send a new request to the webserver.
But when click play button,it read the audio from the cache.
As a result, the file you download maybe not the file you are playing~

Exploit this feature can cause the malicious download attack based on the time gap.
Put a normal audio format file with the .exe extension in the server.
When the user visit the webpage,he can play the audio successfully.
After loading,the attacker can replace the .exe audio with a malware of the same file name.
When the user click download,he download the malware~

Exploit 2:
1.Put the poc.html  && eval.html in the webserver.
2.open the poc.html in the Chrome.
3.click  'open audio in new tab',some unexpected situations will happen~

Exploit this feature can cause a xss attack.
We can put some special content at the end of the audio file with a binary editor.

What is the expected behavior?
Only the legal audio file can be played.

What went wrong?
The browser doesn't detect the legality of a audio file, including the file format and the file extension.

Did this work before? N/A 

Chrome version: 68.0.3440.106  Channel: stable
OS Version: 10.0
Flash Version:
 
poc.html
101 bytes View Download
eval.html
13.7 KB View Download
audio_poc.gif
239 KB View Download
Cc: jialiul@chromium.org
Components: UI>Browser>Downloads Blink>Media>Audio
Labels: Security_Impact-Stable Security_Severity-Low OS-Android OS-Chrome OS-Fuchsia OS-Linux OS-Mac
Owner: maxmorin@chromium.org
Thanks for the report, this seems like a Low Severity bug since if the file is replaced with an executable it would still go through Download Protection (cc'ing jialiul from Chrome Safe Browsing to double check that, if this lets you skip download protection this would probably be a higher severity).

maxmorin: Can you take a look? At first glance it seems like the media player shouldn't try to play audio files with non-audio extensions, but I'm not very familiar with <media> so I'm not sure. Thanks!
<media> should be <audio> in my previous comment.
Yep, confirm that if "open audio in new tab" triggers a download, download protection logic will kick-in. 
Project Member

Comment 4 by sheriffbot@chromium.org, Aug 18

Status: Assigned (was: Unconfirmed)
Cc: maxmorin@chromium.org dalecur...@chromium.org
Owner: mlamouri@chromium.org
I'm not very familiar with the web-facing stuff.
Mounir, Dale: do you know what to do with this bug?
Eh, we get all sorts of URLs with crazy or no extensions since the data can be served from some generating page. I don't think there's anything we can do about this. Once someone clicks open in new tab it'll check the extension and fall back to download (which appears protected) if it's unrecognized.

So I think this is WontFix.
I'm not entirely sure how the download part is related to this issue. Would it be similar if the file was being downloaded via other means than the <audio> or <video> UI?
Status: WontFix (was: Assigned)
I agree with #6, it should be a won'tfix.

Re #7, yep, it's similar to other forms of downloads. 
When I click the 'open audio in new tab', a picture or something else will be presented in a web page.
It is not WYSIWYG.
I know that other browsers have the same issue.
Maybe that’s just some tricks.
Project Member

Comment 10 by sheriffbot@chromium.org, Nov 29

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment