Bogus Firefox XMLHttpRequest Security Bug Report?

Dietrich Kappe, Sunday, July 2, 2006 @ 9:00 am

Not sure if this is a real security issue or not or if the folks at Zabbey are just getting all bent out of shape about nothing.

While developing Zlap I
accidentally ran my test HTML file from my local machine. I was using
the XMLHttpRequest(), commonly used in AJAX software, that is built
into FireFox. The request I was making was to a PHP file that was also
on my local machine and it returned the full contents of said file.
Upon further examination I discovered I could pull any file from any
directory and have it displayed on the machine. I also tried to
replicate this after uploading the test file to my server, luckily it
failed.

What's the big deal? I can't remotely execute the file so we're all
safe. Well sort of. If I can get you to open a perfectly safe HTML file
on your machine I can access your entire system. That's right I can get
the Directory structure, the files and all the contents of those files.

I can execute this script without you knowing. I can upload the
contents of files to my server without you knowing. All I need to do is
get you to run a simple HTML file.

Hmmm, seems like correct behavior. Am I missing something?

Related posts:

1. Security – Yamanner Worm Hits Yahoo Mail (Not!)
2. git how to: ignoring files in git
3. ubuntu + firefox 3.0 + http://localhost = cookies won’t work
4. How to serve static websites and Passenger Rails projects from the same Mac OS X Apache instance
5. Object Pooling and Reusing XMLHttpRequest in IE

Comments (4)

Software Development

Comments: 4 so far

• Leave a comment
• Comment feed for this post
• TrackBack URL

1. 

   Yea, it’s correct behavior. Nothing buggy.
   Even IE 6 will do the same thing.

   This is a security flaw only on the machine where the html file + script has access to the filesystem of the PC.

   Natively, any OS+browser will disallow any remote script to access the client’s filesystem. The only way to access the filesystem via a remote server is to use the File Scripting Objects of IE.
   The coder at Zlap, has overcome that by asking the user to download the html file + script down to the user’s machine.
   When downloaded onto the machine, the file no longer belongs to the internet zone, but instead belongs to the “My Computer” zone [of IE] or it’s equivalent in FF. Far more privileges can be obtained in such a zone.
   This is not a bug, it simply belongs to the uninformed programmer category.

   Comment by Vineet Reynolds, Sunday, July 2, 2006 @ 12:23 pm

2. 

   “This is not a bug, it simply belongs to the uninformed programmer category.”

   And the uninformed rest-of-the world who runs local html files _every_ day. I really don’t understand this mentality that opening a HTML file and granting it access to your entire hard drive without anyone knowing it is OK. I’ve been opening html files for almost a decade and have never been concerned that it might upload sensitive data. I’m curious that programmers think this a good idea but don’t think it’s a good idea to make the public aware of the risks. IE breaks scripts on locally ran files btw.

   Comment by Jeromy, Tuesday, July 4, 2006 @ 8:13 pm

3. 

   Well that’s true. Even I discovered this about a month ago. However, nothing malicious is possible in FF. You can only read files [those allowed by the OS that is] at worst, but you cannot write or append them.
   The FileSystem Object under IE is a different story altogether. I came across this while fixing a company web app and made a mental note to avoid FSO altogether.

   The place where I started off:http://www.codeproject.com/jscript/brwswhta.asp

   Comment by Vineet Reynolds, Wednesday, July 5, 2006 @ 1:51 pm

4. 

   I find the opposite to be a bug. I don’t get the contents of a .url file using XMLHttpRequest. Instead FireFox follows the URL in the url file and returns the contents of that file. I need to inspect the contents of the .url file, as it contains valuable information not contained inside the destination file. IE works correctly. This bug needs to be fixed in Firefox.

   Comment by Jering, Tuesday, February 20, 2007 @ 7:22 am

Leave a comment