FastMail.FM Security Vulnerabilities

https://grepular.com/FastMail_FM_Security_Vulnerabilities

by mike-cardwell • 14 years ago

53 17 14 years ago

Auguste• 14 years ago

  I disclosed them responsibly and they were fixed before I published this blog post.

As a Fastmail.fm user, thanks for your work in improving the service by notifying the team of these vulnerabilities.

rvschuilenburg4• 14 years ago

I noticed my e-mail provider also gave me the JS popup when i clicked the SVG attachment. They are using Horde. Possible horde security flaw?

mike-cardwell5• 14 years ago

If the JavaScript executed, it's a "probable" critical security flaw, rather than a "possible" one. Are they using the latest version? Would you be able to submit a bug report to your provider and/or the Horde project?

[edit] I have alerted security@horde.org

rvschuilenburg4• 14 years ago

I've sent them an e-mail. I will let you know when i know more :)

pinko• 14 years ago

Egads, <webmail software redacted> is also vulnerable (or at least the version deployed by my former employer).

Thank you for the detection tool!

Edit: redacted vendor.

mike-cardwell5• 14 years ago

Thanks for the report. I have just sent a bug report to their security address about this.

It would probably be better if people submitted these bugs directly to the vendor rather than making them immediately public. If you don't know how to do this, or how to describe the bug, you can let me know and I will do it on your behalf. My contact details are in my HN profile

MichaelGG2• 14 years ago

Does anyone else find it rather insane that SVG allows bundling code? "Active" documents like PDF and Office have demonstrated the problems associated. Why does a vector graphic format need scripts?

rpsw• 14 years ago

When you consider SVG can be seen as an potential alternative to Flash for some projects, it is not hard to understand why manipulation through scripting is a desired feature.

MichaelGG2• 14 years ago

So instead of creating a vector format that can be safely used and manipulated from a containing environment (like any other "dumb" image format), they wanted to go make a whole new rich document system? Sigh.

Evbn• 14 years ago

IMO it is a browser bug to let SVG JS interact with anything outside the image canvas sandbox, without explicit user opt in.

wulczer• 14 years ago

Would serving attachment previews from a separate domain, like fastmail-usercontent.fm, help?

mike-cardwell5• 14 years ago

Using a separate domain to display the attachments is a good idea. Gmail does it. It is mentioned towards the end of the blog post. However, that still doesn't get rid of the vulnerability, it just makes it less dangerous.

There should be a strict whitelist of allowed content types, and anything not on that list should be download only. The trouble is, people tend to put "image/*" on that list, because they don't know what an SVG is or what it can do.

wingo• 14 years ago

Nice work, and (as another fastmail.fm user) thank you for the responsible disclosure. May it amply repay you in consulting gigs :)

Regarding the script injection from image file names, there is a simple solution to this problem: separate the data types of strings and document structure. For example:

http://www.gnu.org/software/guile/manual/html_node/Types-and...

FastMail.FM Security Vulnerabilities

Related Stories