Re: with firefox on X11, any page can pastejack you anytime

[David Leadbeater <dgl () dgl cx>]

On Fri, 20 Oct 2023 at 09:55, Turistu <turistu () gmail com> wrote:
[...]
> It pretty much **is** mitigated at that layer. If xterm itself weren't
> filtering out the ESC (ascii 0x1b) character in the pasted data, then
> the bracketed-paste feature of bash or zsh could've been easily bypassed
> by inserting a "\x1b[201~" escape (= end of pasted data) in the payload.
> (As already mentioned in the report too).

I haven't tested all terminal and shell combinations, but the
implementations of bracketed paste mode vary in their correctness,
some do not filter all non-whitespace control characters, so for
example you can add ^C into the exploit HTML:

writeXPrimary('\u0003;touch ~/LOL-' + Date.now() / 1000 +'\r')

Then you get a command being run with no interaction; this appears to
work with xterm (384) + fish for example.

> But there are a thousand more ways for an attacker to leverage that hole
> in Firefox. Many programs (including Firefox itself!) could be easily
> crashed by garbage data from the clipboard. Attacker-controlled data
> could find its way into shell scripts via `var=$(xsel)`, etc.

This isn't just limited to Firefox, one example is terminals that
support OSC 52 (clipboard write), a remote SSH session can be hijacked
and an attacker can inject OSC 52 into the stream in the background (I
looked into this as part of my terminal security research, see [1]).

As you point out there are many ways for untrusted data to end up on
the clipboard, the attack vector here is via the terminal so my
opinion is the terminal is what should protect against it. (Although I
think Firefox could help with some defense-in-depth here, shame they
don't want to.)

For example two terminals that get this right are:

- rxvt-unicode: The confirm-paste extension (loaded in the default
set) pops up a confirmation when pasting control characters (not just
newlines), "y" will strip controls, "p" will paste controls as is.
- Windows Terminal: Strips non-whitespace control characters, asks for
confirmation when pasting newlines, if bracketed paste mode is off.

David

[1]: https://dgl.cx/2023/09/ansi-terminal-security#xterm-osc-52-clipboard