Date: Fri, 20 Oct 2023 12:58:21 +1100 From: David Leadbeater <dgl@....cx> To: oss-security@...ts.openwall.com Subject: Re: with firefox on X11, any page can pastejack you anytime On Fri, 20 Oct 2023 at 09:55, Turistu <turistu@...il.com> wrote: [...] > It pretty much **is** mitigated at that layer. If xterm itself weren't > filtering out the ESC (ascii 0x1b) character in the pasted data, then > the bracketed-paste feature of bash or zsh could've been easily bypassed > by inserting a "\x1b[201~" escape (= end of pasted data) in the payload. > (As already mentioned in the report too). I haven't tested all terminal and shell combinations, but the implementations of bracketed paste mode vary in their correctness, some do not filter all non-whitespace control characters, so for example you can add ^C into the exploit HTML: writeXPrimary('\u0003;touch ~/LOL-' + Date.now() / 1000 +'\r') Then you get a command being run with no interaction; this appears to work with xterm (384) + fish for example. > But there are a thousand more ways for an attacker to leverage that hole > in Firefox. Many programs (including Firefox itself!) could be easily > crashed by garbage data from the clipboard. Attacker-controlled data > could find its way into shell scripts via `var=$(xsel)`, etc. This isn't just limited to Firefox, one example is terminals that support OSC 52 (clipboard write), a remote SSH session can be hijacked and an attacker can inject OSC 52 into the stream in the background (I looked into this as part of my terminal security research, see ). As you point out there are many ways for untrusted data to end up on the clipboard, the attack vector here is via the terminal so my opinion is the terminal is what should protect against it. (Although I think Firefox could help with some defense-in-depth here, shame they don't want to.) For example two terminals that get this right are: - rxvt-unicode: The confirm-paste extension (loaded in the default set) pops up a confirmation when pasting control characters (not just newlines), "y" will strip controls, "p" will paste controls as is. - Windows Terminal: Strips non-whitespace control characters, asks for confirmation when pasting newlines, if bracketed paste mode is off. David : https://dgl.cx/2023/09/ansi-terminal-security#xterm-osc-52-clipboard
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.