Re: Image extension issue in mime.php

On Fri, Aug 22, 2008 at 12:44 AM, Thijs Kinkhorst <[email protected]> wrote:
> On Friday 22 August 2008 09:17, Paul Lesniewski wrote:
>> It's your commit, so maybe you can help.
>>
>> http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4
>>-STABLE/squirrelmail/functions/mime.php?view=log#rev12370
>>
>> If this code is meant to stop "request forgeries through included
>> images", I'd like to know more about what this means, since, as I
>> noted, it wouldn't be hard for an attacker to substitute a dynamically
>> executed script for an "image" file on the target server.  Or perhaps
>> the file extension code is not specifically what fixed that actual
>> issue and is only a side effect?
>
> The patch is actually by Marc. He had some discussion about it with Tomas that
> I could find. As far as I can distill from the mails, but it's a bit of
> guesswork:
>
> - IE interprets JavaScript when served within an "image" (that is, something
> linked from <img src="">.
> - Apparently (?) it doesn't do this when the file has a regular image
> extension, it then processes it as an image. A typical Windows way of working
> I guess.

Hmm.  Can anyone confirm this?  Are there any sample URIs that we can
see for this?

I tried this in IE6:

<img src='javascript:alert("hello")' />

Even when viewing unsafe images (and the file extension list
disabled), this is replaced with the "This image has been removed for
security reasons" image replacement, presumably because the text
"javascript" is found and removed.  So, is the actual fix for the
javascript issue fixed elsewhere and the image file extension list
only intended to avoid showing the "image has been removed" thing when
the user does not expect it (because they already clicked to view
unsafe images)?

Or is there some other URI type that is the real problem here?

I'm still not convinced that the list can't be removed, but am hoping
anyone with more details or knowledge about the issue can voice their
opinion.

> I'm not sure that that is what it's supposed to fix as the mails aren't too
> clear on that. I also don't use IE so can't easily verify this theory.
>
> You could argue that pressing View Unsafe Images leaves you on your own which
> is sort of true, however, my perception of the function was to prevent remote
> tracking, and enabling it would not directly open you up to xss.

My thoughts exactly.

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [email protected]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel