revi-archive/phorge-phorge
1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-12-29 17:00:59 +01:00
Code Issues Releases Wiki Activity

Lock MIME type configuration

Browse source 
Summary:
Ref T6755. This mitigates an attack where you:

  - compromise an administrative account;
  - configure "text/plain" as an "image" MIME type; and
  - create a new macro sourced from a sensitive resource which is locally accessible over HTTP GET, using DNS rebinding.

You can then view the content of the resource in Files. By preventing the compromised account from reconfiguring the MIME types, the server will instead destroy the response and prevent the attacker from seeing it.

In general, these options should change very rarely, and they often sit just beyond the edge of security vulnerabilities anyway.

For example, if you ignore the warnings about an alternate file domain and elect to serve content from the primary domain, it's still somewhat difficult for an attacker to exploit the vulnerability. If they can add "text/html" or "image/svg+xml" as image MIME types, it becomes trivial. In this case not having an alternate domain is the main issue, but easy modification of this config increases risk/exposure.

Test Plan: Viewed affected config and saw that it is locked.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T6755

Differential Revision: https://secure.phabricator.com/D12154
This commit is contained in:
epriestley 2015-03-25 10:16:22 -07:00
parent 17e1e7a65a
commit 6ce4044bfa
1 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src/applications/files/config/PhabricatorFilesConfigOptions.php
View file

@ -89,8 +89,14 @@ final class PhabricatorFilesConfigOptions
) + array_fill_keys(array_keys($image_default), 'fa-file-image-o'); ) + array_fill_keys(array_keys($image_default), 'fa-file-image-o');
// NOTE: These options are locked primarily because adding "text/plain"
// as an image MIME type increases SSRF vulnerability by allowing users
// to load text files from remote servers as "images" (see T6755 for
// discussion).
return array( return array(
$this->newOption('files.viewable-mime-types', 'wild', $viewable_default) $this->newOption('files.viewable-mime-types', 'wild', $viewable_default)
->setLocked(true)
->setSummary( ->setSummary(
pht('Configure which MIME types are viewable in the browser.')) pht('Configure which MIME types are viewable in the browser.'))
->setDescription( ->setDescription(
@ -104,18 +110,21 @@ final class PhabricatorFilesConfigOptions
'the MIME types they are delivered as when they are viewed in '. 'the MIME types they are delivered as when they are viewed in '.
'the browser.')), 'the browser.')),
$this->newOption('files.image-mime-types', 'set', $image_default) $this->newOption('files.image-mime-types', 'set', $image_default)
->setLocked(true)
->setSummary(pht('Configure which MIME types are images.')) ->setSummary(pht('Configure which MIME types are images.'))
->setDescription( ->setDescription(
pht( pht(
'List of MIME types which can be used as the `src` for an '. 'List of MIME types which can be used as the `src` for an '.
'`<img />` tag.')), '`<img />` tag.')),
$this->newOption('files.audio-mime-types', 'set', $audio_default) $this->newOption('files.audio-mime-types', 'set', $audio_default)
->setLocked(true)
->setSummary(pht('Configure which MIME types are audio.')) ->setSummary(pht('Configure which MIME types are audio.'))
->setDescription( ->setDescription(
pht( pht(
'List of MIME types which can be used to render an '. 'List of MIME types which can be used to render an '.
'`<audio />` tag.')), '`<audio />` tag.')),
$this->newOption('files.icon-mime-types', 'wild', $icon_default) $this->newOption('files.icon-mime-types', 'wild', $icon_default)
->setLocked(true)
->setSummary(pht('Configure which MIME types map to which icons.')) ->setSummary(pht('Configure which MIME types map to which icons.'))
->setDescription( ->setDescription(
pht( pht(