8 ms·
Within Google Chrome, WebP images are decoded by the renderer, and therefore any exploit can only get renderer code execution - which is inside a sandbox. Sinc
by londons_explore 3y ago
Within Google Chrome, WebP images are decoded by the renderer, and therefore any exploit can only get renderer code execution - which is inside a sandbox.
Since the renderer is very complex, there are lots of exploits discovered each year for it. However, when someone manages to get code execution in a renderer they don't get much more access than a webpage would normally get. Specifically, they can't see or leave files on the filesystem of your machine, nor even read cookies for other domains.
- sigmoid10 3y agoGetting permissions on a single website user context is already enough considering the vast amount of user uploaded images on the modern internet. It's a bit like XSS on steroids, because it is not limited to one site or frontend.
- londons_explore 3y agoWell websites are stupid if they don't reencode user-uploaded images for precisely this reason... Otherwise an evil client uploads a malicious webp image, which then gets hosted and 'shared' by the server to other users, who upon viewing said image get exploited and share more malicious images...
- masklinn 3y agoUnless you mean the client should transcode before upload (which they can, mind) that mostly makes the server exploitable.
- mortehu 3y agoYou'd set up the server so that it's okay if it gets exploited. For example, maybe its only job is decoding images.
- jiofj 3y agoThen transcode in a different server. Not transcoding user-uploaded files is borderline negligent.
- account42 3y agoTranscoding images is why all old pictures on the web a a blocky mess of unholy JPEG.
- londons_explore 3y agoThere are ways to transcode images in such a way that if they're downloaded and reuploaded to your service you don't lose any further quality in your re-upload.
- kroltan 3y agoAs someone who shared a good deal of Spore creations over the internet, I disagree. (The game would generate a "card" with a visual preview, but would stuff the XML encoding of the creation into some PNG metadata field so the image could be dragged onto someone else's game.)
- dns_snek 3y agoThe server is usually processing the images anyway, at the very least to remove EXIF metadata, but also to resize and compress the images for different resolutions.
- nocsi 3y ago100% Websites that accept complex media from users really are stupid. It’s bad enough sanitizing other input, but the added costs with transcoding and storing user content, all the meanwhile exposing unnecessary risk to processes. I’d just pipe the media upload to Cloudflare and have them deal with it
- saagarjha 3y agoReencoding images doesn’t mean they’re not exploitable anymore.
- Jigsy 3y agohttps://xkcd.com/1683/ https://xkcd.com/1683/
- insanitybit 3y agoThe idea here would be that I'm visiting Reddit, someone uploads a malicious WebP, and now my Reddit account is owned, right?
- ffpip 3y agoSites like Reddit load user uploaded content from different domains (redditmedia.com) so you should be safe in this case.
- IshKebab 3y agoI'm not that familiar with Chrome's process isolation but I think that the renderer process that displays your Reddit.com tab would still render that image, even if it came from a different domain. Chrome doesn't spin up another process to render the image and then transfer the pixels.
- spookthesunset 3y agoWouldn’t the exploit code be able to bypass all those cross domain checks? As long as they are running in the same sandbox, right?
- PhilipRoman 3y agoIt should be noted that some sites (not sure about reddit) will re-encode images in various ways (sometimes to entirely different formats), possibly mitigating this. Exploits aside, there are quite a few undesirable behaviours you can cause with media, such as the bouncing video file which changes it's height every frame and makes content around it reflow.
- insanitybit 3y agoTBH I just used Reddit as an example of "site with images", I'm not actually concerned about my Reddit account/ think it'd be a good target.
- dspillett 3y ago> when someone manages to get code execution in a renderer they don't get much more access than a webpage would normally get Unless of course there is a sandbox break-out exploit to combine this with. So not an immediate priority, unless there is such an exploit in the wild that I don't know about, but important to patch as soon as not terribly inconvenient.
- vinay_ys 3y agoWell, this was exploited in the wild. Here's the actual commit for the bug fix in webp. https://chromium.googlesource.com/webm/libwebp/+/902bc91 https://chromium.googlesource.com/webm/libwebp/+/902bc91
- dspillett 3y agoAye, TFA mentions that. It doesn't say if it breached the sandbox (I'd expect another CVE if there is an active sandbox flaw also), or indeed if the exploit targeted Chrome specifically at all or the library more generally.
- insanitybit 3y agoFeels like it must have, otherwise what would be the point? But perhaps the CVE will come from Microsoft or some other vendor, if it's Renderer -> Kernel exploit.
- dspillett 3y ago> otherwise what would be the point? The exploit could be a PoC that at the moment does something noticeable but relatively innocuous. If there was a sandbox exploit that is already exploited along with this one, I'd expect this announcement to have been held back until when (or after) the other is announced. ACE & RCE bugs should be taken this seriously even if another (as yet not known to exist) bug needs to be chained with it in order to do _real_ damage, because for all we know a black-hat out there could be sat on such a bug hoping no one else notices (and therefore it gets fixed) before something like this comes along to provide the other half of a really serious zero-day PitA.
- amelius 3y agoAre you saying that the renderer can't send information back to the website? Also, perhaps you turned off JavaScript, and now all of a sudden the website can still execute code?
- __s 3y agoI'm using lossless webp, it's much more efficient than png (oops, wrong thread, meant to reply to https://news.ycombinator.com/item?id=37479576 https://news.ycombinator.com/item?id=37479576 "jpeg is good enough")
- lifthrasiir 3y agoThis security bug specifically happens in the WebP Lossless decoder ("VP8L").
- the_sleaze9 3y agoI lol'd
- PedroBatista 3y agoLooks like you're in a position of not losing anything. ( other than a system and accounts due to a hack )
- vntok 3y agoIs it Web scale?