Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 5 Jan 2023 18:29:34 +0100
From: Gabriel Corona <>
Subject: Re: Code execution through MIME-type association of
 Mono interpreter and security expectations of MIME type associations


>> * Firefox and Thunderbird accept "special" MIME types (inode/* and
>>    x-scheme-handler/*) from remote servers;

> Not sure what you mean by “accept”.  Do you mean that download should be
> aborted?

No I mean that Firefox should ignore the Content-Type header for 
choosing an application to handle the file when such a special MIME type 
value is sent by the HTTP server.

Currently when using inode/directory or x-scheme-handler/trash, 
Firefox/Thunderbird proposes to use a file manager to handle the file. 
If the file manager tries to spawn another program to handle the file, 
this might be used to trick the user into thinking he is opening the 
file with a safe program.

A similar exploit might be possible if some application:

* is registered to handle a custom URI scheme (eg. "foo:");
* is not registered to handle regular files;
* can trigger arbitrary code execution when called with a regular file.

This might be expected to be safe. However an attacker might exploit 
this by serving a malicious file with x-scheme-handler/foo: Firefox will 
open the file using the application which will trigger the arbitrary 
code execution.



Download attachment "OpenPGP_signature" of type "application/pgp-signature" (841 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.