Date: Thu, 5 Jan 2023 18:29:34 +0100 From: Gabriel Corona <gabriel.corona@...e.fr> To: oss-security@...ts.openwall.com Subject: Re: Code execution through MIME-type association of Mono interpreter and security expectations of MIME type associations Hi, >> * Firefox and Thunderbird accept "special" MIME types (inode/* and >> x-scheme-handler/*) from remote servers; > Not sure what you mean by “accept”. Do you mean that download should be > aborted? No I mean that Firefox should ignore the Content-Type header for choosing an application to handle the file when such a special MIME type value is sent by the HTTP server. Currently when using inode/directory or x-scheme-handler/trash, Firefox/Thunderbird proposes to use a file manager to handle the file. If the file manager tries to spawn another program to handle the file, this might be used to trick the user into thinking he is opening the file with a safe program. A similar exploit might be possible if some application: * is registered to handle a custom URI scheme (eg. "foo:"); * is not registered to handle regular files; * can trigger arbitrary code execution when called with a regular file. This might be expected to be safe. However an attacker might exploit this by serving a malicious file with x-scheme-handler/foo: Firefox will open the file using the application which will trigger the arbitrary code execution. Regards, Gabriel Download attachment "OpenPGP_signature" of type "application/pgp-signature" (841 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.