Tor: Detect Tor Browser's language

2019-05-2301:21:29

ryotak

hackerone.com

EPSS

0.002

Percentile

61.3%

JSON

#Summary
Some error pages uses Tor Browser’s language based text, and iframe can steal it.

#Details
Since the language of Tor Browser is used for the title of the link tag on 404 error page, an attacker can obtain the language of Tor Browser even if the user has set privacy.spoof_english to 2.
I attached a PoC and a video for this.

If the server returns empty response, Tor Browser will show this page in iframe:

&lt;html class="mozwebext"&gt;
    &lt;head&gt;
        &lt;link rel="alternate stylesheet" type="text/css" href="resource://content-accessible/plaintext.css" title="Wrap Long Lines"&gt;
    &lt;/head&gt;
    &lt;body&gt;
        <pre></pre>
    &lt;/body&gt;
&lt;/html&gt;

but if user uses Japanese (This is example, it can be used in other languages) version of Tor Browser, it’ll show this page:

&lt;html class="mozwebext"&gt;
    &lt;head&gt;
        &lt;link rel="alternate stylesheet" type="text/css" href="resource://content-accessible/plaintext.css" title="長い行を折り返す"&gt;
    &lt;/head&gt;
    &lt;body&gt;
        <pre></pre>
    &lt;/body&gt;
&lt;/html&gt;