CVE-2018-10895: Remote code execution due to CSRF on the qute://settings page
The-Compiler opened this issue · comments
Description
Due to a CSRF vulnerability affecting the qute://settings page, it was
possible for websites to modify qutebrowser settings. Via settings like
editor.command, this possibly allowed websites to execute arbitrary code.
This issue has been assigned CVE-2018-10895.
Affected versions
The issue was introduced in v1.0.0, as part of commit ffc29ee.
It was fixed in the v1.4.1 release, in commit 43e58ac.
All releases between v1.0.0 and v1.4.0 (inclusive) are affected.
Backported patches are available, but no additional releases are planned:
v1.1.x: ff686ff (patch)
v1.2.x: c3361c3 (patch)
v1.3.x: c2ff32d (patch)
v1.4.x: 22148ce (patch)
master: 43e58ac (patch)
Timeline
2018-07-09: I was made aware of the original issue privately (initially
believed by the reporter to only be a DoS issue), developed a fix and contacted
the distros Openwall mailinglist to organize a disclosure date to give
distributions time to coordinate releasing of a fix.
2018-07-10: Slightly updated patch sent to the distros mailinglist.
2018-07-11: Public disclosure.
Mitigation
Please upgrade to v1.4.1 or apply the patches above.
Note that disabling loading of autoconfig.yml is not a suitable remedy, since
settings are still applied until the next restart.
As a workaround, it's possible to patch out the vulnerable code via a
config.py file:
from qutebrowser.browser import qutescheme
qutescheme._qute_settings_set = lambda url: ('text/html', '')While there is no known exploit for this in the wild, users are advised to
check their autoconfig.yml file (located in the config folder shown in
:version) for any unwanted modifications.
Credits
Thanks to:
- toofar for reporting the initial issue.
- Allan Sandfeld Jensen (carewolf) and Jüri Valdmann (juvaldma) of The Qt
Company for their assistance with triaging and fixing the issue. - toofar and Jay Kamat (jgkamat) for reviewing the patch.
- Morten Linderud (Foxboron) for suggestions on how to disclose this
properly.
I filed a Gentoo bug to get this bumped ASAP.
@mschilli87 Those Gentoo bugs are probably not helpful, as the Gentoo maintainer is on the announce mailinglist as far as I know. In this case, the Gentoo package was already updated before you opened the bug...
@The-Compiler yeah I just came back to edit my last comment. Somehow this slipped through a sync so I went ahead and filed it. Better safe then sorry I guess. But all is good now on my end. Sorry for the noise. 🙂