4 ms·

Being not entirely up-to-date on current browser security, what's the risk of a webpage just including a CSS: @font-face { src: url("/fonts/evil-font.ttf")

by pierrec 10y ago

Being not entirely up-to-date on current browser security, what's the risk of a webpage just including a CSS: @font-face { src: url("/fonts/evil-font.ttf"); ... } And making use of these? Do current browsers even use windows libraries for font handling? Edit: reading further, the article actually mentions two browser exploits, the first of which links to a proof-of-concept which is just a font file. So yes, it seems that just including a carefully-crafted font (an OTF in this case) could take your shellcode directly to the kernel.

kevingadd 10y ago
Native font rendering is used on Windows, yes, though in theory a browser could run some sort of sanitizer on TTFs. Not sure offhand whether they do, but it's reasonable.
- pierrec 10y ago
  Regarding the question of whether browsers sanitize the fonts, I'm looking at the chromium issue linked to what the article calls a "weaponized exploit", and even though it's marked as fixed (obviously), it's not clear whether they marked it as such because windows released a security update or because chrome did with sanitation. While the idea of monkey-patching kernel bugs through sanitation is kind of ugly, it would be also be ugly to rely on windows updates, considering that many people are furiously/incorrectly disabling them because of the ridiculous windows 10 update behavior... https://bugs.chromium.org/p/project-zero/issues/detail?id=369 https://bugs.chromium.org/p/project-zero/issues/detail?id=36...
  - yuhong 10y ago
    I think the issue of XP/Server 2003 systems that will never receive a patch are more important. What is fun is the MS15-077/MS15-078 fiasco where one ATMFD patch was released for Server 2003 and another about a week later was not. OTS has been used for a long time now by browsers BTW.
  - ryuuchin 10y ago
    It's marked fixed because Microsoft released a patch for it. However at the very least Chrome and Firefox have been doing font sanitization for quite some time now (several years+ I believe). I'm not sure for other browsers. Opera might since it's just a Chromium fork and OTS[1] is a part of the WTF (webkit tools framework). [1] https://github.com/khaledhosny/ots https://github.com/khaledhosny/ots
    - zeta0134 10y ago
      Wait, since when is Opera a Chromium fork? They've been around a lot longer than the Chrome project. Unless they had a radical change of heart recently that I haven't heard about yet?
      - acqq 10y ago
        Published on 12 February 2013: "300 Million Users and Move to WebKit" https://dev.opera.com/blog/300-million-users-and-move-to-webkit/ https://dev.opera.com/blog/300-million-users-and-move-to-web... "Opera sends 90 out the door" "They were sacrificed for strategic choice to dump core technology, with Opera's proprietary engine Presto and JavaScript interpreter Carakan" https://news.ycombinator.com/item?id=5237967 https://news.ycombinator.com/item?id=5237967
- kalleboo 10y ago
  Firefox does include a font sanitizer https://support.mozilla.org/en-US/questions/913498 https://support.mozilla.org/en-US/questions/913498
- ryuuchin 10y ago
  Both Firefox and Chrome use font sanitizers[1]. I'm not sure about others, Opera probably does since it's just a Chromium fork and OTS is part of the WTF (webkit tools framework). AFAIK its been used for quite some time now, several years+. The license for OTS is permissive so I don't see why it couldn't also be used in Edge/IE although I've no idea if they do (or if they rolled their own even). [1] https://github.com/khaledhosny/ots https://github.com/khaledhosny/ots
  - acqq 10y ago
    And it seems that Flash and Adobe Reader don't use the sanitizers, according to the article? Tangential, anybody knows how Apple handles fonts?
    - ryuuchin 10y ago
      Reading commit messages from Chrome's support[1][2][3] for win32k system call disable mitigation (aka win32k lockdown) on Windows (specifically for PPAPI plugins) I think Flash, at least in Chrome, loads fonts from the browser. Which would mean it gets passed through OTS. I think all processes now share a common font cache on Chrome or at the very least they share code related to handling fonts. Just looking at the fact that Flash still works with win32k lockdown enabled (meaning it can't use any GDI system calls) is probably enough evidence on its own (maybe). I don't know how other browsers handle font handling with Flash. [1] https://bugs.chromium.org/p/chromium/issues/detail?id=523278 https://bugs.chromium.org/p/chromium/issues/detail?id=523278 [2] https://bugs.chromium.org/p/chromium/issues/detail?id=523278#c11 https://bugs.chromium.org/p/chromium/issues/detail?id=523278... [3] https://bugs.chromium.org/p/chromium/issues/detail?id=523278#c19 https://bugs.chromium.org/p/chromium/issues/detail?id=523278...
- wslh 10y ago
  It seems they check it with ots: https://cs.chromium.org/chromium/src/third_party/ots/README?sq=package:chromium&dr=C https://cs.chromium.org/chromium/src/third_party/ots/README?...

by pierrec 10y ago

kevingadd 10y ago

Native font rendering is used on Windows, yes, though in theory a browser could run some sort of sanitizer on TTFs. Not sure offhand whether they do, but it's reasonable.

pierrec 10y ago
Regarding the question of whether browsers sanitize the fonts, I'm looking at the chromium issue linked to what the article calls a "weaponized exploit", and even though it's marked as fixed (obviously), it's not clear whether they marked it as such because windows released a security update or because chrome did with sanitation. While the idea of monkey-patching kernel bugs through sanitation is kind of ugly, it would be also be ugly to rely on windows updates, considering that many people are furiously/incorrectly disabling them because of the ridiculous windows 10 update behavior... https://bugs.chromium.org/p/project-zero/issues/detail?id=369 https://bugs.chromium.org/p/project-zero/issues/detail?id=36...
- yuhong 10y ago
  I think the issue of XP/Server 2003 systems that will never receive a patch are more important. What is fun is the MS15-077/MS15-078 fiasco where one ATMFD patch was released for Server 2003 and another about a week later was not. OTS has been used for a long time now by browsers BTW.
- ryuuchin 10y ago
  It's marked fixed because Microsoft released a patch for it. However at the very least Chrome and Firefox have been doing font sanitization for quite some time now (several years+ I believe). I'm not sure for other browsers. Opera might since it's just a Chromium fork and OTS[1] is a part of the WTF (webkit tools framework). [1] https://github.com/khaledhosny/ots https://github.com/khaledhosny/ots
  - zeta0134 10y ago
    Wait, since when is Opera a Chromium fork? They've been around a lot longer than the Chrome project. Unless they had a radical change of heart recently that I haven't heard about yet?
    - acqq 10y ago
      Published on 12 February 2013: "300 Million Users and Move to WebKit" https://dev.opera.com/blog/300-million-users-and-move-to-webkit/ https://dev.opera.com/blog/300-million-users-and-move-to-web... "Opera sends 90 out the door" "They were sacrificed for strategic choice to dump core technology, with Opera's proprietary engine Presto and JavaScript interpreter Carakan" https://news.ycombinator.com/item?id=5237967 https://news.ycombinator.com/item?id=5237967
kalleboo 10y ago
Firefox does include a font sanitizer https://support.mozilla.org/en-US/questions/913498 https://support.mozilla.org/en-US/questions/913498
ryuuchin 10y ago
Both Firefox and Chrome use font sanitizers[1]. I'm not sure about others, Opera probably does since it's just a Chromium fork and OTS is part of the WTF (webkit tools framework). AFAIK its been used for quite some time now, several years+. The license for OTS is permissive so I don't see why it couldn't also be used in Edge/IE although I've no idea if they do (or if they rolled their own even). [1] https://github.com/khaledhosny/ots https://github.com/khaledhosny/ots
- acqq 10y ago
  And it seems that Flash and Adobe Reader don't use the sanitizers, according to the article? Tangential, anybody knows how Apple handles fonts?
  - ryuuchin 10y ago
    Reading commit messages from Chrome's support[1][2][3] for win32k system call disable mitigation (aka win32k lockdown) on Windows (specifically for PPAPI plugins) I think Flash, at least in Chrome, loads fonts from the browser. Which would mean it gets passed through OTS. I think all processes now share a common font cache on Chrome or at the very least they share code related to handling fonts. Just looking at the fact that Flash still works with win32k lockdown enabled (meaning it can't use any GDI system calls) is probably enough evidence on its own (maybe). I don't know how other browsers handle font handling with Flash. [1] https://bugs.chromium.org/p/chromium/issues/detail?id=523278 https://bugs.chromium.org/p/chromium/issues/detail?id=523278 [2] https://bugs.chromium.org/p/chromium/issues/detail?id=523278#c11 https://bugs.chromium.org/p/chromium/issues/detail?id=523278... [3] https://bugs.chromium.org/p/chromium/issues/detail?id=523278#c19 https://bugs.chromium.org/p/chromium/issues/detail?id=523278...
wslh 10y ago
It seems they check it with ots: https://cs.chromium.org/chromium/src/third_party/ots/README?sq=package:chromium&dr=C https://cs.chromium.org/chromium/src/third_party/ots/README?...