9 ms·

On VBScript

124 points by wglb 8y ago

wglb 8y ago
One interesting bit: If an attacker-controlled data is interpreted as a VBScript variable, this can result in a lot more than just infoleak and can easily be converted into a code execution. This issue is a good example of why, in general, an out-of-bounds read can be more than an infoleak: it always depends on precisely what kind of data is being read and how it is used. How leaks can become RCE.
tlb 8y ago
VB's evaluation order, in which the left side of an assignment is evaluated before the right side, seems like a terrible idea. In most languages including C and C++, it's specified that the RHS is evaluated first. Since, of course, the RHS might have a side effect on the location of the LHS. Is there some advantage to LHS-first that I can't think of?
- userbinator 8y ago
  including C and C++, it's specified that the RHS is evaluated first. I did not check C++ but for C, according to ISO/IEC 9899:1999 section 6.5.16 paragraph 4 on the semantics of the assignment operator: "The order of evaluation of the operands is unspecified."
  - tlb 8y ago
    Gosh, you're right. Clang warns, at least: t-order.c:10:8: warning: unsequenced modification and access to 'x' [-Wunsequenced] foo[x++] = x;
    - ngcc_hk 8y ago
      Language that is complicated in syntax also ended up with discussion like that. A couple of day ago you have the VisiCalc guy talked about he need to do a stack machine against the expectation here. Think of lisp But then lisp require parentheses Think of j but the strange right hand side then fork/train. It is hard for this simple thing. Even = and =: get Python dictator for life resigned. Just hard
- eropple 8y ago
  Just guessing, but perhaps it's more intuitive to non-programmers/casual users? You read left-to-right.
  - MagicPropmaker 8y ago
    אני לא קורא משמאל לימין
    - chrismorgan 8y ago
      Not closely related, but this made me think of another fascinating aspect of localisation. In places like Australia and America, if you have a group of people and you’re going round them (e.g. reading in turns or playing various card games), you’d be more likely to go clockwise from on top rather than counter-clockwise. But in India, they naturally go counter-clockwise from on top rather than clockwise, and I once saw someone playing a game of hearts on a phone there, and it was going counter-clockwise. Localisation definitely entails more than just translating strings. Layout and functionality changes can be involved.
      - marton78 8y ago
        In my native Hungary we also play counter clockwise, so I looked it up[1]: Dealing is done either clockwise or counterclockwise. If this is omitted from the rules, then it should be assumed to be: * clockwise for games from North America, North and West Europe and Russia; * counterclockwise for South and East Europe and Asia, also for Swiss games and all Tarot games. [1] https://www.pagat.com/mech.html https://www.pagat.com/mech.html
    - ygra 8y ago
      In Latin script you do. Most programming languages I know are not in Hebrew. And even then the LHS would be first in reading order, I'd assume.
    - sho 8y ago
      Oh yes you do, or you couldn't even use this site, let alone do any programming. For better or worse left-to-right has "won" in programming-land and I fully agree with alangpierce that it's the natural choice for evaluation order as well. We read left-to-right and the computer should as well. That's one of the main problems I have with Python. Evaluating right-to-left just feels like being contrarian.
- alangpierce 8y ago
  Interesting, my intuition is the opposite: that left-to-right evaluation is clearly the better approach. I just tested a few languages and it turns out that there's no clear agreed-upon answer, but LHS first seems to be more common at least for recent languages: LHS first: JavaScript, Java, Go, C#, Swift, PHP, Ruby RHS first: C++, Python, Rust I ran this sort of code for all of them: def lhs(): print "LHS"; return 0 def rhs(): print "RHS"; return 0 a = [0] a[lhs()] = rhs() "=" is syntactically just a binary operator, so I expect it to behave like other binary operators (and AFAIK all other binary operators evaluate left-to-right in almost all languages). It's special because the LHS evaluates to an assignable reference rather than to a value, but nothing stops you from evaluating the left side in full before starting to evaluate the right side. As with every binary operator, it's possible to write code such that the evaluation of one side affects the result of evaluating the other side, but of course that sort of code is really fragile anyway.
  - bArray 8y ago
    And this is why I tend to use a slightly smaller subset of some of the features that C-family languages support, along with an abundance of brackets. If I remember rightly, there is the example: a = {-1, -1} x = 0 a[++x] = x print(a[0] + " " + a[1]) Depending on the language (and sometimes even if you have optimizations set for those that compile to binaries), you'll get a different answer. I always love (read sarcasm) to see awesome code, such as: z = a & b > c | d or: z = a > b ? c < d ? e : f : g ? h : i And then of course, the statement: "my code doesn't need comments because the code comments itself"...
    - lern_too_spel 8y ago
      Don't do that. The behavior is explicitly undefined in C. http://c-faq.com/expr/seqpoints.html http://c-faq.com/expr/seqpoints.html
      - oblio 8y ago
        Don't do what, precisely? He listed several examples. And I think he's agreeing with you, he's just sarcastic.
- minitech 8y ago
  > Since, of course, the RHS might have a side effect on the location of the LHS. That’s a reason it matters which one is evaluated first, but not a reason to evaluate the RHS first.
- kodablah 8y ago
  In some languages like Go that support multi assignment, evaluation of some parts of the LHS occur first to help with pointer indirection and index clause evaluation [0][1]. I assume this makes the multi assign predictable because the locations of the LHS are known before the RHS is started. 0 - https://golang.org/ref/spec#Assignments https://golang.org/ref/spec#Assignments 1 - https://golang.org/ref/spec#Order_of_evaluation https://golang.org/ref/spec#Order_of_evaluation
- rienbdj 8y ago
  Better to avoid computations on the Lhs entirely!
- int_19h 8y ago
  Evaluating expressions left-to-right is a simple rule that can be universally applied, and produces predictable results. The problem here, in any case, isn't the order of evaluation. It's that the array bound check is done at the wrong time.
- beobab 8y ago
  I seem to remember my university lecturer (way back in '96) demonstrating that rightmost evaluation could lead to "variable capture", but that "leftmost-outermost" evaluation would always avoid that problem. It's been a while, however, so I might be remembering wrong (or indeed have misunderstood).
qwerty456127 8y ago
> Windows 10 Fall Creators Update, Microsoft disabled VBScript execution in Internet Explorer in the Internet Zone and the Restricted Sites Zone by default I'm very surprised this hasn't been done a decade ago.
- codeflo 8y ago
  At this point, it's probably safe to assume that every feature in Windows that hasn't been touched for the last decade has severe security problems. And it's not only Microsoft -- maybe their approach to backwards compatibility makes them especially vulnerable, but similar things have happened in the free software ecosystem as well. It's basically a very insidious form of bitrot. So what's the lesson here? Aggressively remove old features, as you suggest? Rewrite everything every few years? Software has become way too complex to closely audit everything forever...
  - giancarlostoro 8y ago
    > but similar things have happened in the free software ecosystem as well. Shellshock comes to mind. https://en.wikipedia.org/wiki/Shellshock_(software_bug) https://en.wikipedia.org/wiki/Shellshock_(software_bug)
  - pjmlp 8y ago
    Security only works properly when applied to all layers. It is very educative to read about security models on Multitics, ClearPath, System 360/370, OS/400 among many other similar systems, their attack vectors, and what we ended up getting by having winner takes it all with UNIX based systems. This year we celebrated 30 years of Morris worm.
    - watersb 8y ago
      > This year we celebrated 30 years of Morris worm. Wow. That was one hell of a night. Melted down our university computer labs, packed with desperate undergrads trying to complete and turn in their projects before midnight deadline...
csours 8y ago
Poor, ancient VBScript! Oh, how you would benefit from Raymond Chen's time machine...
lixtra 8y ago
It feels like the language got too much features and then the model got so complicated that devs could no longer correctly reason about it. I would suspect that such errors are less likely in a simple language like lisp. Did similar exploits happen in JavaScript?
- colordrops 8y ago
  JavaScript is not hard to reason about.
  - BigJono 8y ago
    Just wait a few years.
- arethuza 8y ago
  "simple language like lisp" I guess some lisps might be simple but I wouldn't call Common Lisp simple!
mevile 8y ago
It's crazy to me to realize that there are still people employed at Microsoft who work on VBScript. I love VBScript, lots of great memories, but I don't know anyone who uses it anymore, not even VB.Net.
- agumonkey 8y ago
  I used VB a bit after a bit of linux/bash and I was super sad that MS never (even though it's not surprising[1]) marketed VB as a system customization language for Windows'es. It's not a great language, but at least it has some kinds of type, and with COM modules you can tap into just about anything in your OS (for better or worse of course). Bash felt like a string grep hell very fast to me. And nowadays powershell seems a great replacement. [1] of course Windows wasn't meant for tinkerers but for users/customers, developping was for the MSDN side of things, for which you'd agree to pay because you'd sell your creations I guess
- ocdtrekkie 8y ago
  A lot of business line applications are still written in VB.NET. Personally, I write all of my hobby code in VB.NET since it's more or less the same as writing C# but I find VB syntax more comfortable. There's even claims it's the fifth most popular language out there today. https://visualstudiomagazine.com/articles/2018/12/17/tiobe-vb-net.aspx https://visualstudiomagazine.com/articles/2018/12/17/tiobe-v... Though there's not a lot of other parties who agree with that, on one hand, on the other hand, a shockingly large number of developers do not work in Silicon Valley, and a lot of those developers aren't using the latest JavaScript frameworks for their day-to-day jobs.
  - gscott 8y ago
    I am probably the last person but I do everything in asp classic vbscript and SQL Server full time since 1998. Internet development can't just be for people with expensive cs degrees.
    - Jaruzel 8y ago
      Replying to you, and ocdtrekkie. I'm not alone! I know multiple coding languages but for fun coding (i.e. I'm not being paid to do it) I fallback to VB.Net as I just don't have to think about it, it just flows from my fingers. Once it's an EXE it's no different from C# and as no-one else has to support my code, who cares that it's in VB.Net. I actually don't understand the hate that VB.Net gets. I think maybe people are just biased based on their knowledge of bad VB code from the VB6 and earlier days. I'm also a huge fan of ASP. It's small, fast, and super simple to deploy onto any Windows server. If you are just writing a small web based tool for end users that's easy for people to maintain, then ASP is still definitely the way to go for Windows Web servers. By comparison, I've recently converted a few ASP tools to PHP that run on the same spec of hardware (under debian, not Windows) and PHP is definitely slower than ASP.
ec109685 8y ago
Why doesn’t Internet Explorer / Microsoft sandbox VBScript like Chrome does?
Digit-Al 8y ago
Weirdly I just get a blank page when I look at this.
- zyx321 8y ago
  Blogspot does not like it when you disable Javascript.
peteretep 8y ago
So I got downvoted last time I brought this up, but if a large corporation hasn't fuzzed their products / code, doesn't this start to border on negligence? Bugs will of course happen, but failure to fuzz products from companies that employ tens of thousands of people seems inexcusable.
- oconnor663 8y ago
  Fuzzing is great and undefined behavior is terrible, so I mostly agree with you. But negligence is a high bar, so let me add at least a small counterpoint: These big, old systems are full of crashes. Many of them have been triggered and investigated before, and determined not to be a security vulnerability, and so left as they are. If you fuzz these systems, you might find a lot more false positives than real exploitable vulnerabilities. It might be even worse than that, with the false positives being so many that they get in the way of the fuzzer actually discovering new issues. If these were newer projects, it might make sense to really clean the codebase up and fix every crash. That would make debugging tools more useful, and it would avoid future cases where some compiler update turns your "harmless" crash into an exploit. But in these legacy projects, that sort of cleanup would be very expensive, and many of the devs with the expertise to do a proper job of it have long since moved on. It really might not make economic sense to invest that much in cleanup, even if Microsoft has fully internalized the cost of vulnerabilities to their users.
- da_chicken 8y ago
  It should, but it doesn't. People haven't quite figured out that when software becomes infrastructure that software engineering should look a lot more like civil engineering.
  - pjmlp 8y ago
    There are a couple of countries where signing off projects as software engineer does indeed require similar validation. Sadly we are still quite far from the ideal way. For that we need more escalations on company lawsuits so that it actually becomes more professional.
- 8y ago

124 points by wglb 8y ago

wglb 8y ago

One interesting bit: If an attacker-controlled data is interpreted as a VBScript variable, this can result in a lot more than just infoleak and can easily be converted into a code execution. This issue is a good example of why, in general, an out-of-bounds read can be more than an infoleak: it always depends on precisely what kind of data is being read and how it is used. How leaks can become RCE.

tlb 8y ago

VB's evaluation order, in which the left side of an assignment is evaluated before the right side, seems like a terrible idea. In most languages including C and C++, it's specified that the RHS is evaluated first. Since, of course, the RHS might have a side effect on the location of the LHS. Is there some advantage to LHS-first that I can't think of?

userbinator 8y ago
including C and C++, it's specified that the RHS is evaluated first. I did not check C++ but for C, according to ISO/IEC 9899:1999 section 6.5.16 paragraph 4 on the semantics of the assignment operator: "The order of evaluation of the operands is unspecified."
- tlb 8y ago
  Gosh, you're right. Clang warns, at least: t-order.c:10:8: warning: unsequenced modification and access to 'x' [-Wunsequenced] foo[x++] = x;
  - ngcc_hk 8y ago
    Language that is complicated in syntax also ended up with discussion like that. A couple of day ago you have the VisiCalc guy talked about he need to do a stack machine against the expectation here. Think of lisp But then lisp require parentheses Think of j but the strange right hand side then fork/train. It is hard for this simple thing. Even = and =: get Python dictator for life resigned. Just hard
eropple 8y ago
Just guessing, but perhaps it's more intuitive to non-programmers/casual users? You read left-to-right.
- MagicPropmaker 8y ago
  אני לא קורא משמאל לימין
  - chrismorgan 8y ago
    Not closely related, but this made me think of another fascinating aspect of localisation. In places like Australia and America, if you have a group of people and you’re going round them (e.g. reading in turns or playing various card games), you’d be more likely to go clockwise from on top rather than counter-clockwise. But in India, they naturally go counter-clockwise from on top rather than clockwise, and I once saw someone playing a game of hearts on a phone there, and it was going counter-clockwise. Localisation definitely entails more than just translating strings. Layout and functionality changes can be involved.
    - marton78 8y ago
      In my native Hungary we also play counter clockwise, so I looked it up[1]: Dealing is done either clockwise or counterclockwise. If this is omitted from the rules, then it should be assumed to be: * clockwise for games from North America, North and West Europe and Russia; * counterclockwise for South and East Europe and Asia, also for Swiss games and all Tarot games. [1] https://www.pagat.com/mech.html https://www.pagat.com/mech.html
  - ygra 8y ago
    In Latin script you do. Most programming languages I know are not in Hebrew. And even then the LHS would be first in reading order, I'd assume.
  - sho 8y ago
    Oh yes you do, or you couldn't even use this site, let alone do any programming. For better or worse left-to-right has "won" in programming-land and I fully agree with alangpierce that it's the natural choice for evaluation order as well. We read left-to-right and the computer should as well. That's one of the main problems I have with Python. Evaluating right-to-left just feels like being contrarian.
alangpierce 8y ago
Interesting, my intuition is the opposite: that left-to-right evaluation is clearly the better approach. I just tested a few languages and it turns out that there's no clear agreed-upon answer, but LHS first seems to be more common at least for recent languages: LHS first: JavaScript, Java, Go, C#, Swift, PHP, Ruby RHS first: C++, Python, Rust I ran this sort of code for all of them: def lhs(): print "LHS"; return 0 def rhs(): print "RHS"; return 0 a = [0] a[lhs()] = rhs() "=" is syntactically just a binary operator, so I expect it to behave like other binary operators (and AFAIK all other binary operators evaluate left-to-right in almost all languages). It's special because the LHS evaluates to an assignable reference rather than to a value, but nothing stops you from evaluating the left side in full before starting to evaluate the right side. As with every binary operator, it's possible to write code such that the evaluation of one side affects the result of evaluating the other side, but of course that sort of code is really fragile anyway.
- bArray 8y ago
  And this is why I tend to use a slightly smaller subset of some of the features that C-family languages support, along with an abundance of brackets. If I remember rightly, there is the example: a = {-1, -1} x = 0 a[++x] = x print(a[0] + " " + a[1]) Depending on the language (and sometimes even if you have optimizations set for those that compile to binaries), you'll get a different answer. I always love (read sarcasm) to see awesome code, such as: z = a & b > c | d or: z = a > b ? c < d ? e : f : g ? h : i And then of course, the statement: "my code doesn't need comments because the code comments itself"...
  - lern_too_spel 8y ago
    Don't do that. The behavior is explicitly undefined in C. http://c-faq.com/expr/seqpoints.html http://c-faq.com/expr/seqpoints.html
    - oblio 8y ago
      Don't do what, precisely? He listed several examples. And I think he's agreeing with you, he's just sarcastic.
minitech 8y ago
> Since, of course, the RHS might have a side effect on the location of the LHS. That’s a reason it matters which one is evaluated first, but not a reason to evaluate the RHS first.
kodablah 8y ago
In some languages like Go that support multi assignment, evaluation of some parts of the LHS occur first to help with pointer indirection and index clause evaluation [0][1]. I assume this makes the multi assign predictable because the locations of the LHS are known before the RHS is started. 0 - https://golang.org/ref/spec#Assignments https://golang.org/ref/spec#Assignments 1 - https://golang.org/ref/spec#Order_of_evaluation https://golang.org/ref/spec#Order_of_evaluation
rienbdj 8y ago
Better to avoid computations on the Lhs entirely!
int_19h 8y ago
Evaluating expressions left-to-right is a simple rule that can be universally applied, and produces predictable results. The problem here, in any case, isn't the order of evaluation. It's that the array bound check is done at the wrong time.
beobab 8y ago
I seem to remember my university lecturer (way back in '96) demonstrating that rightmost evaluation could lead to "variable capture", but that "leftmost-outermost" evaluation would always avoid that problem. It's been a while, however, so I might be remembering wrong (or indeed have misunderstood).

qwerty456127 8y ago

> Windows 10 Fall Creators Update, Microsoft disabled VBScript execution in Internet Explorer in the Internet Zone and the Restricted Sites Zone by default I'm very surprised this hasn't been done a decade ago.

codeflo 8y ago
At this point, it's probably safe to assume that every feature in Windows that hasn't been touched for the last decade has severe security problems. And it's not only Microsoft -- maybe their approach to backwards compatibility makes them especially vulnerable, but similar things have happened in the free software ecosystem as well. It's basically a very insidious form of bitrot. So what's the lesson here? Aggressively remove old features, as you suggest? Rewrite everything every few years? Software has become way too complex to closely audit everything forever...
- giancarlostoro 8y ago
  > but similar things have happened in the free software ecosystem as well. Shellshock comes to mind. https://en.wikipedia.org/wiki/Shellshock_(software_bug) https://en.wikipedia.org/wiki/Shellshock_(software_bug)
- pjmlp 8y ago
  Security only works properly when applied to all layers. It is very educative to read about security models on Multitics, ClearPath, System 360/370, OS/400 among many other similar systems, their attack vectors, and what we ended up getting by having winner takes it all with UNIX based systems. This year we celebrated 30 years of Morris worm.
  - watersb 8y ago
    > This year we celebrated 30 years of Morris worm. Wow. That was one hell of a night. Melted down our university computer labs, packed with desperate undergrads trying to complete and turn in their projects before midnight deadline...

csours 8y ago

Poor, ancient VBScript! Oh, how you would benefit from Raymond Chen's time machine...

lixtra 8y ago

It feels like the language got too much features and then the model got so complicated that devs could no longer correctly reason about it. I would suspect that such errors are less likely in a simple language like lisp. Did similar exploits happen in JavaScript?

colordrops 8y ago
JavaScript is not hard to reason about.
- BigJono 8y ago
  Just wait a few years.
arethuza 8y ago
"simple language like lisp" I guess some lisps might be simple but I wouldn't call Common Lisp simple!

mevile 8y ago

It's crazy to me to realize that there are still people employed at Microsoft who work on VBScript. I love VBScript, lots of great memories, but I don't know anyone who uses it anymore, not even VB.Net.

agumonkey 8y ago
I used VB a bit after a bit of linux/bash and I was super sad that MS never (even though it's not surprising[1]) marketed VB as a system customization language for Windows'es. It's not a great language, but at least it has some kinds of type, and with COM modules you can tap into just about anything in your OS (for better or worse of course). Bash felt like a string grep hell very fast to me. And nowadays powershell seems a great replacement. [1] of course Windows wasn't meant for tinkerers but for users/customers, developping was for the MSDN side of things, for which you'd agree to pay because you'd sell your creations I guess
ocdtrekkie 8y ago
A lot of business line applications are still written in VB.NET. Personally, I write all of my hobby code in VB.NET since it's more or less the same as writing C# but I find VB syntax more comfortable. There's even claims it's the fifth most popular language out there today. https://visualstudiomagazine.com/articles/2018/12/17/tiobe-vb-net.aspx https://visualstudiomagazine.com/articles/2018/12/17/tiobe-v... Though there's not a lot of other parties who agree with that, on one hand, on the other hand, a shockingly large number of developers do not work in Silicon Valley, and a lot of those developers aren't using the latest JavaScript frameworks for their day-to-day jobs.
- gscott 8y ago
  I am probably the last person but I do everything in asp classic vbscript and SQL Server full time since 1998. Internet development can't just be for people with expensive cs degrees.
  - Jaruzel 8y ago
    Replying to you, and ocdtrekkie. I'm not alone! I know multiple coding languages but for fun coding (i.e. I'm not being paid to do it) I fallback to VB.Net as I just don't have to think about it, it just flows from my fingers. Once it's an EXE it's no different from C# and as no-one else has to support my code, who cares that it's in VB.Net. I actually don't understand the hate that VB.Net gets. I think maybe people are just biased based on their knowledge of bad VB code from the VB6 and earlier days. I'm also a huge fan of ASP. It's small, fast, and super simple to deploy onto any Windows server. If you are just writing a small web based tool for end users that's easy for people to maintain, then ASP is still definitely the way to go for Windows Web servers. By comparison, I've recently converted a few ASP tools to PHP that run on the same spec of hardware (under debian, not Windows) and PHP is definitely slower than ASP.

ec109685 8y ago

Why doesn’t Internet Explorer / Microsoft sandbox VBScript like Chrome does?

Digit-Al 8y ago

Weirdly I just get a blank page when I look at this.

zyx321 8y ago
Blogspot does not like it when you disable Javascript.

peteretep 8y ago

So I got downvoted last time I brought this up, but if a large corporation hasn't fuzzed their products / code, doesn't this start to border on negligence? Bugs will of course happen, but failure to fuzz products from companies that employ tens of thousands of people seems inexcusable.

oconnor663 8y ago
Fuzzing is great and undefined behavior is terrible, so I mostly agree with you. But negligence is a high bar, so let me add at least a small counterpoint: These big, old systems are full of crashes. Many of them have been triggered and investigated before, and determined not to be a security vulnerability, and so left as they are. If you fuzz these systems, you might find a lot more false positives than real exploitable vulnerabilities. It might be even worse than that, with the false positives being so many that they get in the way of the fuzzer actually discovering new issues. If these were newer projects, it might make sense to really clean the codebase up and fix every crash. That would make debugging tools more useful, and it would avoid future cases where some compiler update turns your "harmless" crash into an exploit. But in these legacy projects, that sort of cleanup would be very expensive, and many of the devs with the expertise to do a proper job of it have long since moved on. It really might not make economic sense to invest that much in cleanup, even if Microsoft has fully internalized the cost of vulnerabilities to their users.
da_chicken 8y ago
It should, but it doesn't. People haven't quite figured out that when software becomes infrastructure that software engineering should look a lot more like civil engineering.
- pjmlp 8y ago
  There are a couple of countries where signing off projects as software engineer does indeed require similar validation. Sadly we are still quite far from the ideal way. For that we need more escalations on company lawsuits so that it actually becomes more professional.
8y ago