I typed this up last night but forgot to post it:
Before I start this thread - I can't reproduce this on any Firefox instance I have access to, so I'm asking for help from people with Firefox handy for testing purposes. I'm in the middle of a really complicated architectural assessment and I randomly ran across some strange behavior in Firefox when looking at the way it parses certain URL structures. At first it looks like it's not interesting, just odd, but then I figured out a way to potentially use it to spoof referrer checks in very specific situations. First let me describe the behavior.
When I go to a URL like this:
http://foo:bar@bank.com/ it will send the user credentials "foo" and "bar" to the bank. Firefox has long ago decided this is dangerous behavior. So first it will do a request to the URL as you click on it to decide if it needs basic auth or not. If not, it will pop up a warning that the site may be trying to trick the consumer. This was a common trick used by phishers a few years back. Okay, fair enough. But what if I just put the @ symbol there? Does it send anything?
Let's try something like
http://@bank.com/. Well at first it looks like nothing happened. It just removed the @ symbol and took you to bank.com. No warning, no nothing. Same host headers. So it looks like it worked fine. But if you actually watch the referrers being sent to the images linked to the page you get to see some of the weirdest behavior I've ever encountered in a browser. Here's what the header will look like:
http://ank.com/
No, I didn't mis-type, it actually removes the first character. Okay, but what practical application could this possibly have? At first I couldn't think of anything until I started thinking about the way people surf the Internet. A lot of people type in things like "http://bank.com/" instead of "http://www.bank.com/" out of laziness/efficiency. Lots of webservers are configured to work on both domains too. There's also a situation where people write (in my opinion very sloppy) anti-CSRF code that looks for referrers of any of their sub-domains. The code would look something like this (psuedo-code):
if (($ENV{HTTP_REFERER} =~ /^http:\/\/[a-z0-9\-\.]*\.bank.com\//) or
($ENV{HTTP_REFERER} =~ /^http:\/\/bank.com\//)) {
//do something sensitive
}
If you look at the URL and look at what's possible it opens new avenues for potential referrer spoofing in Firefox. So I would simply need to register something like xbank.com and set up a URL for Firefox users to click on or be iframed like so:
http://@xbank.com/
I know what you're saying, "Wrong domain, idiot. And no referrer yet anyway!" Yes yes, but the index page of xbank.com then points to the anti-CSRF script on bank.com. That script then gets the wrong referrer (that of bank.com instead of xbank.com). Yup, pretty convoluted, but it would work in Firefox! I doubt this will find much actual use in reality, but there you have it. Just another browser oddity that could lead to exploitation. Granted I was unable to get this working anywhere else, but it was tested on Firefox 2.0.0.11 with a mess load of extentions. Can anyone re-create this?
- RSnake
Gotta love it.
http://ha.ckers.org
Edited 1 time(s). Last edit at 01/30/2008 01:12PM by rsnake.
